1. Agent presents AAP token to API (capability: "document.read")
2. API validates AAP token (RS validation)
3. API calls Zanzibar to check if agent can read specific document
4. Both checks must pass for request to succeed