Allowlists Are Not Spending Caps: Two Different Security Properties, Often Confused

A breakdown of why token allowlists and spending caps prevent different things, and three concrete ways an 'allowlist-only' authorization can still be exploited.