I would suggest using PKI certificate extensions and create an extension in the certificate that has a list of permissions. Beta Server provides a certificate t

I would suggest using PKI certificate extensions and create an extension in the certificate that has a list of permissions. Beta Server provides a certificate to Gamma server with the permissions it has, and after validation, it will look into a custom extension that has all the permissions Beta server is granted. The good thing here is that you don't need Alpha server anymore.