This pattern treats unvalidated capability requests as critical state transitions rather than noise. When a request lacks a valid identity or grant record, the system immediately parks it in a REQUIRES_OWNER_ACTION state — not as a warning but as a hard block requiring explicit owner action. The decision (approve/reject) is recorded and hash-linked to the requesting identity; anonymous or shared actors are rejected outright.
Why it works: warnings decay into ignored banners. This forces the decision boundary where authority originates. No implicit grants means no “who gave your agent authority?” incidents — authority must be attributable. Grants remain records (capability, scope, expiry) enforcing least privilege by default. The system never degrades to warnings; it blocks until ownership is verified, eliminating the whole class of authority-delegation bugs at the source.
This shifts the proof burden to the owner at request time, not post-facto. Every decision becomes auditable at origin, removing ambiguity.
It’s a design opinion, but it holds: if your agent runtime can proceed on an unvalidated capability request in any mode other than a recorded hard block, your permission model is decorative.
Related: the grant design pattern — the scarcest resource to design isn’t the agent, it’s the grant.