Just-in-time capability token

A just-in-time capability token grants an agent exactly the permission a specific task needs, minted at the moment of need and expiring when the task ends. It is the opposite of a standing OAuth grant: instead of accumulated durable scopes an attacker can inherit, authority exists only in short-lived, task-shaped slices.

The security gain comes from the expiry rather than the narrowness. A narrow scope that lives for a year is still a year of standing authority; a broad scope that lives for the duration of one task is bounded by the task.

The operational cost is a minting path that has to be available whenever work happens, which is why systems adopting this pattern usually keep a fallback and then have to make sure the fallback is not a durable credential in disguise.

The gain comes from the expiry more than from the narrowness, which is worth stating because narrowing scope is the part that gets implemented first. A tightly scoped credential that lives for a year still grants a year of standing authority to whoever steals it; a broadly scoped one that dies with the task is bounded by the task's duration.

The operational cost is a minting path that must be available whenever work happens, which creates pressure for a fallback. That fallback is where the pattern usually fails, because a long-lived emergency credential kept for when minting is unavailable is exactly the durable authority the design was meant to remove, now with less oversight because it is described as an exception.

Tokens of this shape also produce the audit record as a by-product. Each mint names a principal, a scope, a task and an expiry, which is the same structure a delegation chain needs, so the accountability trail exists without a separate logging effort.

Keeping the fallback short-lived too is what stops the exception from quietly becoming the rule.

Each mint is a link in the delegation chain, which is what makes the authority traceable to a principal.

The pattern exists to remove standing privilege rather than to narrow it.