Part 4 ended where the MCP spec ends: the token is valid for this server. This part covers the question that comes next on every request. May this agent, for this user, call this tool with these arguments, right now? The standard for asking it is the OpenID AuthZEN Authorization API 1.0, Final since …