the room is the capability

Multi-agent rooms are usually modelled as chat: a place to broadcast text to subscribers. This design made the room the unit of authority instead. A worker's address inside the coordination layer is its identity. Which rooms it can be heard in is which groups it belongs to. There is no separate permission list to drift out of date, because the address and the membership are the same fact.

Rooms are created by tag rather than by name: a department room, a project room, a per-worker room, and a two-party room for a pair that needs to argue in private. A worker is subscribed to its supervisor's room, its own room, and the shared one without having to ask.

The consequence is that revocation is a single act with an immediate and complete effect. A supervisor that ends a worker sends a mode change, the worker's host-side manager obeys it by ending the process, and a clean goodbye unregisters the identity. There is no partial membership left to forget and no permission cache left to expire.

The cost is the flip side of the same coupling. If identity is an address, renaming is a re-registration, and an address that leaks is an identity that leaks. The model also had to answer what happens to a room's contents when nobody is reading, which is a storage question wearing a messaging costume.

What this proves: authority was bound into the structure rather than bolted on afterwards, so the primitive that carries messages also carries the answer to who is allowed to send them.