Limited-access tokens that you can give to others are often useful, but there are other ways to do it. If your application is a monolith with an API, you're go

Limited-access tokens that you can give to others are often useful, but there are other ways to do it. If your application is a monolith with an API, you're going to have to implement all the permissions yourself anyway, right? That includes the UI for setting up the permissions and generating the cookie, the code for checking permissions, and the code for actually doing the work. Might as well keep the cookies very simple and put the permissions in the database. Once you have plugins with their own permissions, possibly running on their own servers, it starts to make more sense.