Mint a short-lived scoped token whose scopes limit what the holder can do, e.g. install a specific asset on a device through the registry. The token is verified offline by services holding the token signing public key and cannot be revoked, so keep TTLs short. It is bound to the authenticated caller's organization.