This reminds me of the Grok/Bankrbot incident, where a request hidden in Morse code ended up causing a transfer. Decoded content crossed the boundary into authority to spend.

Having the chain enforce spending limits seems useful here. But a compromised agent could still make an unwanted payment within its allowance. A per-transaction cap could also become a much larger loss through repeated transactions.

That seems like a useful test case for these scoped authorities: recipient restrictions, allowed operations, cumulative spending limits, and revocation that doesn’t depend on the agent cooperating. Which parts would the chain enforce, and what would the agent still be trusted to decide?

Do you have a fork, branch, or commit with tests demonstrating those boundaries? I’d like to see how it behaves when the authorized agent is the thing being manipulated.