RBAC groups permissions into roles you assign to identities. It works for org charts; it strains for agents that need per-task, per-hop authority.
Roles are coarse and sticky: you end up with an "agent" role that's a superset of everything any agent might do, and no clean way to say "this instance, for this task, may do only this." Delegation is worse — RBAC has no native notion of an identity handing a subset of its role to another identity, offline, that can only narrow.
A capability token is minted per task with exactly the needed authority and nothing else, and attenuates as it's delegated. You can layer capabilities on top of RBAC — use roles to decide what warrants a principal may issue, then let warrants carry the fine-grained, per-task authority to the agents.
Free to self-host. 10,000 free decisions on the hosted gateway — no card.
Get an API key Read the docs