You might want to check out Biscuit:

> Biscuit is an authorization token with decentralized verification, offline attenuation and strong security policy enforcement based on a logic language

— https://www.biscuitsec.org