Detect agent entitlement drift from scope changes, delegation depth, stale grants, owner gaps, and system sensitivity