Maybe I stated it wrong. Macaroons have the ability to attenuate the restrictions _without_ contacting the auth server, which makes it IMO fit for restricting and attenuating as much as you want, without much cost.

If I need a roundtrip to the auth server to attenuate, I am not necessarily going to do it as often.

Most token formats delegate. Macaroons support attenuation, confinement, and embedded third-party claims, none of which are JWT capabilities.

I am very aware of your work!

It's the only prod usage of Macaroons I know of, I think.

Third-party discharge seems like a great way to have human-in-the-loop gating, among other interesting things.

Would be great reading your thoughts if you ever write about the agentic use case, having all the fly.io experience

Are you thinking of macarons? Macaroons are coconut.