Computer-implemented system and method for detecting dangerous or unauthorised capabilities assembled over time by autonomous artificial-intelligence agents across software contributions, project surfaces and runtime layers, attributing capability primitives to agents, models, sessions and human principals, evaluating cross-layer asset reachability and composed authority using temporal capability and relationship-aware authorisation graphs, identifying minimal contributing sets by counterfactual removal, and automatically controlling deployment, credentials, workloads or agent sessions