Author here. The argument is that most of what looks like attenuation in an agent tree is really just static authorization. Gateways and agentic runtimes need to work together to provide bulletproof attenuation.