Proof-of-possession (holder binding)

Holder-binding makes a stolen warrant useless: only whoever holds the matching private key can present it.

Bearer tokens leak

A bearer token works for anyone who copies it. For an agent that spends money, that's a real risk — logs, memory dumps, and MITM all leak tokens. A pop (proof-of-possession) caveat binds the warrant to a public key; using it requires signing a fresh challenge with the matching private key.

Presenting a bound warrant

The agent proves possession at call time — a short signature over a challenge (with a bounded time skew to stop replay). A copied warrant without the private key simply fails. This upgrades a warrant from "bearer" to "holder-bound" without changing how it's issued or attenuated.