Delegate access an agent's owner already holds to the agent, time-boxed. Unlike create this persists the request directly instead of returning a flow link -- an agent authenticates with an API token and has no browser to run a flow in, so no justification is ever collected. That is why the agent may only ask for what its owner already has: the owner's approval is then the whole decision, and no reviewer is asked to judge a request with nothing in it. The returned fulfill_url is what the agent hands to its owner so they can act on it.