Build monitoring that tracks how permissions flow through delegation chains. Alert when: a sub-agent receives permissions that are equal to or broader than the orchestrator's permissions (scope expansion flag); a low-privilege agent directly performs an action that should require a high-privilege agent; an agent receives scopes that don't match its registered capabilities in the agent registry; or a delegation chain reaches a depth that exceeds your policy limit.

Un-scoped privilege inheritance (Scenario 01) and identity sharing (Scenario 07) often aren't visible at the point of action — they look like normal agent activity. The anomaly is in the permission structure, not the individual action. This requires monitoring that understands the delegation chain, not just the final API call.

Alert on specific patterns that indicate AG03 attacks in progress:

Scope expansion requests: an agent that was issued a narrow token requests additional scopes — especially if this hasn't happened before for this agent type.

Token reuse outside original intent: a token issued for task A is being used for task B with a different resource, purpose, or time context than the original signed intent.

Device-code flow initiated by an agent: device authorization endpoints are designed for human-operated limited-input devices. An agent initiating a device-code flow is an anomaly — it should be completing standard OAuth flows, not device-code flows.

Cross-agent privilege elevation pattern: a low-privilege agent instructs a high-privilege agent to perform an action, and the original authorization chain for that action doesn't trace back to a user with sufficient authority.

MIT 08 and 09 are your visibility layer. When Scenarios 03, 04, and 06 succeed — because prevention controls were misconfigured, bypassed, or not yet deployed — these detections give you a chance to respond before the damage compounds. Log agent identity, delegation chain, token provenance, and action scope for every privileged operation.