the agent whose declared grant is exceeded by a child.
the local handle of the offending sub-agent.
the resolved child agent key.
the permissions the child declares that the parent does NOT grant (silently dropped under intersection).
the agent whose declared grant is exceeded by a child.