Authorize on Paradigm (you act — on their page)
GET /my-permissions — it sees only its own grant for you, the live consent ∩ realm. Nothing else.
Why this is honest. The only way this app gets a realm is you approving it on
app.ofself.ai/authorize — the real consent page. The server here uses no owner token;
it reads the app's own /my-permissions (app key) and the public DLR, and links you to
Paradigm to authorize. To verify the machinery: authorize with one realm, re-check; then
re-authorize with a different realm and re-check — the app's effective access changes to match,
and needs_reauth flips when the realm can't cover the DLR. The app never sees other apps
or the raw ceiling — that boundary is the point.