What is actually in one

Four objects, and the order they come in matters.

• The mandate — what the agent is authorised and expected to do. Elicited, because you already know it.
• The grant — everything it can actually do. Measured, from the deployment shape, the account and the credentials. It is almost never enumerated anywhere, and it is reliably larger than whoever deployed it expected.
• The delta — permitted, and nobody asked for it. Derived, and recomputed whenever either input moves.
• The barrier — what stands between the agent and each capability. Four kinds, and only one of them is a control: a setting the agent's own account can flip is not one, because the grant includes the ability to remove it.

A grant on its own is an inventory, and nobody acts on an inventory. Your agent can do sixteen things is a shrug. Your agent can do sixteen things and you authorised five is a finding.