Why is logging in not enough to authorize an agent or device to cause an effect?

Authentication answers who is requesting. Authority answers what that identity may cause, right now, on this resource. A stolen credential must not inherit unlimited powers. Hood is not a password manager.

Deployment scope is determined during evaluation. Hood does not prove that AI will always be safe.

If this problem matches your environment, START with the systems, effects and authority boundary you need to control.