Wouldn't you run into the autonomous/not-autonomous problem? Delegating or not delegating buy power is a binary choice. There's no real middle ground (past "do

Wouldn't you run into the autonomous/not-autonomous problem? Delegating or not delegating buy power is a binary choice. There's no real middle ground (past "do it securely" best practices). Or are you looking at this from a centralized revokation lever perspective? If that, then use the same architecture patterns that enterprise credential stores use -- authorizing credentials only at rest in the credential store, pulled temporarily by automated systems, with credentials rotated regularly.