Issuer-side delegation policy expressed with shipped primitives. The issuing principal mints verbs on its nonDelegable list with delegations-remaining 0, so the capability is usable but cannot pass down. Per-agent overrides are independently minted per-bearer grants, and replace-not-merge falls out because each agent's token is its own mint with its own narrowed scope. maxDepth needs nothing new: it is delegations-remaining, already shipped and enforced on every chain walk.
The work here is the issuing path's policy surface (which verbs are nonDelegable, which bearers hold what), not new token machinery.
Issuer-side delegation policy expressed with shipped primitives. The issuing principal mints verbs on its nonDelegable list with delegations-remaining 0, so the capability is usable but cannot pass down. Per-agent overrides are independently minted per-bearer grants, and replace-not-merge falls out because each agent's token is its own mint with its own narrowed scope. maxDepth needs nothing new: it is delegations-remaining, already shipped and enforced on every chain walk.
The work here is the issuing path's policy surface (which verbs are nonDelegable, which bearers hold what), not new token machinery.