{
  "adjudicated": false,
  "design_arounds": {
    "attenuation": "macaroons / Biscuit / UCAN tokens with caveats",
    "epoch invalidation": "short-lived tokens + central revocation list",
    "mcpgate": "API gateway with OPA sidecar",
    "proxy detection": "ML monitoring dashboards with human review",
    "replay": "event-sourced audit log"
  }
}