Authorizing at the start of a workflow is not sufficient to prove that every downstream operation was authorized, because each delegation may introduce new principals, capabilities, destinations, or data exposure surface.