Capability tokens, not roles

RBAC is fine until it isn't. The moment you need "this service can call that service, but only on Tuesdays, for this tenant, for the next four minutes", roles become a combinatorial mess. Capabilities with caveats let you express that as data.

1// a caveat is a predicate the verifier checks
2tok := issuer.New().
3    Caveat("op", "read").
4    Caveat("tenant", tenantID).
5    Caveat("exp", inFourMinutes()).
6    Discharge()

Roles answer "who are you?". Capabilities answer "what are you allowed to do, here, now?". The second question is the one attackers care about.