A conversation that follows you across devices is a product feature. Authority that follows the conversation is a security decision.
Agent sessions are becoming portable. Anthropic's Chrome side panel now runs a full Cowork session: conversations save to your history, your skills and connectors work in the browser, and a task you start in a tab can be finished on desktop, web, or mobile. Sessions live with the account, not the machine. Grok Bot, persistent Copilot sessions, and every agent teammate product are heading the same way.
Users will expect exactly this. Resuming a task should not mean re-explaining it.
But two things are travelling together, and only one of them should. Context should be portable: what we were doing, what we found, what is left. Authority is different — the browser logins the agent is acting through, the connector scopes, the approval someone gave twenty minutes ago on a different surface for a specific action in a specific state.
The honest version of this is risk-tiered, not paranoid. Nobody should re-authorise a summary. But resuming a session is a reasonable moment to ask whether a high-consequence grant still holds — particularly when the surface changed, the environment changed, or the approval was given against a state that has since moved.
Worth saying: the credible implementations already know this. Anthropic ships the side panel in an approve mode that reviews each action and pauses on the consequential ones, runs Claude Code's browser in an isolated profile rather than your logged-in one, and states plainly that browser agents remain exposed to prompt injection. That is the right shape of answer.
Continuity of context and continuity of permission are two different product decisions. The first should be generous. The second should expire.