I think that's correct since each added caveat builds on the previous one. I don't have the formal knowledge to understand the full underpinnings of it, but it

I think that's correct since each added caveat builds on the previous one. I don't have the formal knowledge to understand the full underpinnings of it, but it always seemed to me (from implementing validation of them and looking at many authZ systems) that many of the sharing and delegation features of current apps would be so much neater in a macaroon based system.