The MovieLabs vision calls for zero-trust security, while tracker APIs hand out broad tokens. What least-privilege scopes and audit logging let an agent update task status and upload versions without being able to approve final delivery or delete assets?
Why this is still open: Pages read describe the vision and API existence; per-endpoint scope models were not examined.