Scope a token properly

The most common misunderstanding about agent tokens: tovio agent new has no path, lane, operation or clearance flags. You do not narrow a token by passing scope arguments at issuance. Two mechanisms narrow one, and knowing which is which is the whole article.

Mechanism one — mark the paths, not the token

Every agent token is excluded from every policy-protected path. So the way to put a directory out of an agent's reach is to protect it:

tovio policy set 'infra/**' --read 'role=admin'

An agent token issued afterwards is excluded from infra/** at the scope stage — before policy is evaluated, before any decryption, and without leaking what the policy requires.

This does not reach back. The exclusion list is snapshotted into each token when it is minted, and enforcement reads the token's own fields rather than re-consulting the manifest. Protecting a path today does not narrow a token issued yesterday. If agents are mid-task when you protect something, revoke their tokens and reissue — that is the only thing that applies the new exclusion to them.

With that caveat understood, this is still the mechanism to reach for. It scopes every future agent at once, it survives someone forgetting a flag, and it is the same declaration that protects the path from everything else.

Mechanism two — delegate something narrower

An agent holding --can-delegate mints sub-tokens through MCP's issue_sub_token, and those take explicit paths, lanes, operations and an expiry — each one provably contained in the parent. Per-task narrowing lives there.

There is no tovio agent delegate command. Delegation is an agent-side operation, not an operator-side one.

Expiry is the dimension you set directly

tovio agent new <name> --model <id> --task <text> --expires-in 2

Hours, as a plain number. Match it to the task, not to the project. Renew a token that is still working rather than issuing one that outlives its reason.

Check what a token actually holds

tovio agent show <token-id>tovio agent list --json

Both report the path scope, the excluded paths, the lane scope, clearance and expiry. An MCP client can ask the same question of itself with the effective_scope tool.

effective_scope is a courtesy, not the gate

The scope echo exists so a well-behaved agent can avoid doomed calls. It is not the enforcement point. The engine re-runs the full check on every single call, regardless of what the agent believes it holds — so an agent that lies to itself about its scope simply gets refused.