If I want to give an agent "deploy to staging, then deploy to production if staging succeeds," I have to grant both tokens upfront. The agent could misuse the production token even if staging failed. You need conditional tokens (e.g., DeployToken("production", requires_token="staging", requires_success=True)) or token chaining (consuming token A unlocks token B).
If I want to give an agent "deploy to staging, then deploy to production if staging succeeds," I have to grant both tokens upfront. The agent could misuse the production token even if staging failed. You need conditional tokens (e.g., DeployToken("production", requires_token="staging", requires_success=True)) or token chaining (consuming token A unlocks token B).