Token downscoping without central exchange

Design a token-exchange service (RFC 8693 style) for a platform where a user-facing request fans through a chain of internal services, and each downstream hop must run with a NARROWER token than the one it received, never broader. A request that entered with scope 'read+write all projects' must reach the billing service holding only 'read project:42 billing', so a compromised deep service can't replay its token to do more than its job. At ~200k exchanges/sec, you can't make every hop call a central server synchronously. Discuss the exchange protocol, how downscoping is enforced and made verifiable, audience binding, and how you keep latency low.