Proposal: audit events for scope and ownership refusals of agents #2569

Part of #2423 (F-MCP). A proposal for the maintainer to decide on, raised by the post-merge review of #2503 and #2512.

Today these refusals of an agent leave no audit event:

• a scope refusal (agent_scope_denied)
• an ownership refusal (agent_not_change_set_owner)
• a credential revoked or expired during a call
• a request refused at the transport (401)

This matches SEC-08 as written, which lists credential created and revoked, cap exceeded, injection flagged and routing rule changed. Each refused tool call is still in the tool call log as failed or refused, with its tool, agent, model and task id.

Proposal

• Record agent.scope_denied and agent.not_owner as security events, so the desk's security view (SEC-08, F-DSK) shows an agent probing beyond its scope.
• Keep transport 401s out of the audit log, because nothing identifies the caller, and leave them to the host's logs.
• Rate-limit repeated identical denials from one credential into one event per period, so a looping agent cannot flood the log.

To decide

• Should scope and ownership denials be security events, beyond what SEC-08 lists?
• If so, should SEC-08 in 05-non-functional-requirements.md name them?