This is the key insight. A human's intent holds for the whole command. An agent's intent is rewritten every token. You can't auth them the same way.