After stage 7

What you just learned

If you can say this in your own words, the lab worked.

An AI agent sometimes needs to pass work to another agent. The second agent should get only the access that piece of work requires, and it should not be able to give itself or anyone else more access than it received.

And if you got further than that:

An agent's identity tells you which agent is acting. It does not tell you what that agent was allowed to do for this particular job.

Neither sentence uses a technical term. Here are the terms, now that you have the ideas they attach to.

Term	Where you met it
Ambient authority	Stage 1. Permission that follows the agent everywhere instead of following the job.
Identity-based access control	Stage 2. Permissions attached to who is acting.
Confused deputy	Stage 4. An agent with real authority being steered into using it for the wrong job.
Policy service	Stage 4. A central place every check has to ask, which is what your fix built, whatever you called it.
Delegation	Stage 4. Passing work, and the access for it, to another agent.
Privilege escalation	Stage 4. Ending up with more access than you were given.
Attenuation	Stage 5. Access that can narrow when it is passed on, and can never widen.
Capability	Stage 5. Permission carried by the request rather than looked up about the requester.
Trust root	Stage 5. The one key that can sign a fresh permission, and that no agent holds.
Holder binding	Stage 6. A permission that only works for whoever it was issued to.
Prompt injection	The whole lab. Instructions hidden in data that an agent reads and follows.

Going further

The authorization system you used in stages 5 to 7 is open source at github.com/tenuo-ai/tenuo. The delegation rules behind it are being written up as an IETF standards draft, which is public and readable. A star on the repository is the main way maintainers find out anyone is using their work.