AI agent blast radius: nothing bounds the union of grants

An AI agent's blast radius is the union of every grant you never revoked. Least privilege bounds each grant, not how long it stays open.