An authorization survey names runtime enforcement as the unsolved piece.

89 primary sources from about 180 candidates published 2023-2026, organized around a five-tier principal hierarchy: human user, operator/deployer, orchestrator agent, sub-agent, tool endpoint (arXiv 2609.15906). Covers agent identity and credential lifecycle, delegation and scope propagation across multi-hop chains, just-in-time runtime enforcement, prompt injection treated as authorization bypass rather than a content problem, and auditability. Output is seven structural requirements, a four-layer reference architecture and three deployable configurations, with runtime enforcement and aggregation bounds flagged as open.