Today, almost all of our initial security alerts are triaged by intelligence before humans are looped in. This helps reduce toil for defenders, improves response time, and lets humans spend time where their skills are most leveraged—in discernment, judgement, and applied expertise.
OpenAI已经把AI部署为安全运营的第一道防线：机器处理初级分类，人类只介入需要判断力的高价值决策。这正是EP.99「分级授权成为默认」的核心逻辑——AI拿走执行层，人类保留决策层，权责边界通过技术设计而非人工约定来划定。
The idea behind TAC and CVP is to give trusted defenders better models so they can report bugs and vulnerabilities to companies
EP.99 故事线B: TAC（可信访问计划）本质上是一个「分级授权」实验——将高能力模型开放给被信任的安全研究员，而非完全限制。这正是 EP.99 预测的「分级授权成为默认」趋势的早期落地案例。
Delegated Acts: Article 290 of the Lisbon Treaty introduces the novel concept of “delegated acts” to supplement or amend non-essential elements of framework legislation, i.e. issues of general scope. On a case-by-case basis, the Council and European Parliament set the conditions for the delegation of power: objectives, content, scope and duration of the delegation are defined in each basic legal act. The Council or European Parliament may revoke this delegation and a delegated act adopted by the Commission can only enter into force if no objection has been raised by one of the legislators within a time period set by the basic act.授权行为：《里斯本条约》第290条引入了“授权行为”的新概念，以补充或修改框架立法的非必要要素，即一般范围的问题。理事会和欧洲议会根据具体情况设定权力下放的条件：每项基本法律法案都规定了权力下放的目标、内容、范围和期限。理事会或欧洲议会可以撤销这一授权，并且只有在基本法案规定的期限内没有一位立法者提出反对意见的情况下，委员会通过的授权法案才能生效。
范围进限定在非必要要素上
Spring Cloud Gateway + Jwt + Oauth2 实现网关的鉴权操作