Is portable, delegatable authority actually useful on Solana?
I've been thinking about a primitive where authority itself is an on-chain account that can be delegated and attenuated.
For example:
Root: $100k/day
↓
Agent A: $10k/day
↓
Agent B: $1k/day
A child capability can only become more restrictive, never more powerful. Revoking the root epoch invalidates the entire subtree.
The interesting problem is consumption.
If B has a $1k capability:
Treasury B: $600
Marketplace B: $600
Two independent programs can each verify the capability and unknowingly authorize $1,200.
One solution is making the capability program a shared consumption authority via CPI, but then every consumer contends on the same writable account and the capability program still can't verify whether the consuming program actually delivered what it claimed.
So I'm wondering:
Is this a useful primitive, or am I reinventing existing Solana delegation/session-key/account-abstraction patterns?
And is the portability vs verifiable enforcement tradeoff fundamental?
I'd appreciate brutal technical criticism.