Macaroons — and their public-key successor, biscuits — are tokens the holder can narrow by adding caveats, without ever contacting the issuer.
Google's macaroons introduced a token whose bearer can append caveats (restrictions), each chained by an HMAC so it can only add constraints. Biscuits brought this to public-key crypto and a richer policy language. The property that matters for agents: you can hand someone a strictly-less-powerful version of your token, offline.
Liceat's CW1 warrant is in this lineage — public-key, offline-verifiable, attenuable — with additions agents need: stateful spend and rate caveats enforced against real history, proof-of-possession holder-binding, cascading revocation, and a built-in transparency log.
Free to self-host. 10,000 free decisions on the hosted gateway — no card.
Get an API key Read the docs