Short-lived tokens only limit how long a credential works, but better than nothing. i.e. They don't stop an unwanted action while it's still valid.

A practical pattern is an outside broker: the guest never sees the real credential and can't pick the destination, only a path from an allowlist.

Shameless plug for my project, I maintain one of these brokers: Plimsoll's broker sits outside the sandbox, injects the upstream credential itself, matches method + exact path (no query strings, no traversal, no encoding tricks), and enforces (some limitations that I am want to improve) a total call budget plus per-route caps. So a task can be granted "GET /items/* plus at most one job submission" even when the underlying key is coarser.

Worth a look if you're thinking about narrower credentials for services whose keys are still coarse: https://github.com/plimsollmark/plimsoll (docs/capability-grants.md, and the broker walkthrough at https://plimsollmark.github.io/plimsoll/trainers/brokering.h...).