Deliberately not named "audience" — that term already has a specific,
unrelated meaning in OAuth2/OIDC (a token's aud claim, matched against a
resource server's own identifier). This is Frodo's own concept: today's
admin-account and service-account auth modes are already full-trust
identities, so 'full-trust' is the universal default every capability
gets unless explicitly narrowed. 'delegated' marks a capability safe for
a non-admin caller resolved via a real interactive (browser) login — see
ops/CallerTrustTierOps.ts's determineCallerTrustTier(). 'both'
covers capabilities safe for either.
Caller-privilege tier a capability is safe to expose to.