Capability Token
A credential that encodes exactly what an agent may do, often including allowed tools, targets, budgets, expiry, and delegation limits.
Plain English
It is a narrow permission slip for one agent task instead of a broad API key.
Example
A refund agent receives a token that allows `refund.write` up to $50 for one customer and expires after the workflow ends.
Why it matters
Capability tokens reduce ambient authority and give teams evidence for who authorized each tool-mediated action.