You've described the problem that macaroons [0] intend to solve by amending an hmac access token with constraints on its use. The described scenario of appendin

You've described the problem that macaroons [0] intend to solve by amending an hmac access token with constraints on its use. The described scenario of appending a hme circuit to evaluate policy requests sounds much more expensive (both in terms of effort to answer 'can this request send an email?' and size of the token) than a key:value pair. [0] https://fly.io/blog/api-tokens-a-tedious-survey/#macaroons https://fly.io/blog/api-tokens-a-tedious-survey/#macaroons