Question
Design a token-exchange service (RFC 8693 style) for a platform where a user-facing request fans through a chain of internal services, and each downstream hop must run with a NARROWER token than the one it received — never broader. A request that entered with scope 'read+write all projects' must reach the billing service holding only 'read project:42 billing', so a compromised deep service can't replay its token to do more than its job. At ~200k exchanges/sec, you can't make every hop call a central server synchronously. Discuss the exchange protocol, how downscoping is enforced and made verifiable, audience binding, and how you keep latency low.
Clarify scale and constraints first. Propose a clean component breakdown, then go deep on the hard parts — data model, bottlenecks, consistency, failure modes — and name the trade-offs you are making.