They are auth tokens, like JWTs or macaroons. And there is an associated policy language. > That was one of the motivating goals for Biscuit: what if we could

They are auth tokens, like JWTs or macaroons. And there is an associated policy language. > That was one of the motivating goals for Biscuit: what if we could attenuate the token, but still be able to verify it with public key cryptography? Avoid having to share a critical secret across many services. > With Biscuit, there's another way. Authorization policies can be provided by the verification service, but they can also be carried by the token. The service can specify its policies, and the user can attenuate tokens with their own policies. And they will all be evaluated in the same way, while guaranteeing that the token cannot get more rights with user policies. So from an initial token, an entire parallel authorization design can be developed that will still be compatible with the original one.