privilege leaks and session tears happen when integrations inherit admin capabilities across tool boundaries, so background agents mutate roles without an audit row. scaffolding without explicit identity boundaries is just deferred privilege escalation.