I keep seeing "scoped credentials" touted as the savior for agent security, but when I peel back the layers on most implementations, it's just the old ACL model dressed up with a new JSON schema. The core failure is conflating *where* an agent can operate with *what* it can do *and for how long*.

The typical pattern I review looks like this:
```json
{
"agent_id": "task_runner_7",
"scopes": ["s3:read:bucket-a", "dynamodb:write:table-b"]
}
```
This is handed to the agent as a token. It's an improvement over a raw admin key, granted. But it's static. It's attached to the agent's identity, not to a specific *intent* or *workflow*. If the agent is compromised, those scopes are valid until the key rotates, which might be never. This is just an IAM policy with a fancy name.

Where this falls apart for agents is the temporal dimension and context. An agent performing a single task to summarize a user's file doesn't need a persistent `s3:read` scope on that bucket. It needs a credential that:
1. Is valid only for the duration of that specific summarization attempt.
2. Is limited to that one file path.
3. Cannot be reused for any other operation, even on the same file.
4. Is bound to the user's session, not the agent's own identity.

Most libraries and frameworks I see are generating the former, not the latter. They're provisioning long-lived (or medium-lived) capability tokens based on agent roles. The "scope" is just a pre-computed permission set. The real need is for dynamically minted, ephemeral credentials where the *issuance* is the access control event, not the evaluation of the token's embedded claims.

We should be aiming for patterns where the orchestrator or a secure broker, upon receiving a user-authorized task, obtains a truly scoped and time-boxed credential (e.g., an OAuth 2.0 DPoP token, or a signed AWS STS `AssumeRole` with a 5-minute TTL and a single-object prefix) and injects it solely into the lifetime of that specific agent instance. The credential dies with the task.

Without this, we're building a slightly narrower, but still dangerously long, leash for attackers.