OAuth 2.0 Token Exchange (RFC 8693)

Scored both ways, the alternative first. These pages are read by the vendors they name, and a comparison that loses no rows is read as marketing.

Where it wins

A ratified standard with implementations in every major language, audited for a decade, and an actor claim that genuinely expresses delegation. If your chain is one hop deep, this is the correct answer and adding anything to it is overhead.

Where it cannot go

No ordered chain of principals, no per-link attenuation, no revocation pointer, and no representation of a spend or approval limit. At two hops the actor claim stops carrying enough to refuse on.

↑ delegated authority→ the spec, v0.3↓ the verifier