Yes, Capability Myths Demolished describes the &quot;revocable forwarder&quot; pattern, which uses a proxy to delegate access in a revokable manner.<p>Macaroons on the other hand are nice because they don&#x27;t need a proxy to solve this problem: the authorizer can issue a short-lived &quot;discharge Macaroon&quot; to authorize access, then the client can get to the target resource directly without the need to use a proxy. To revoke access: just refuse to issue subsequent discharge Macaroons when the current discharge expires.