  Controlled sharing is fundamental to distributed systems. We consider a
capability-based distributed authorization system where a client receives
capabilities (access tokens) from an authorization server to access the
resources of resource servers. Capability-based authorization systems have been
widely used on the Web, in mobile applications and other distributed systems.
  A common requirement of such systems is that the user uses tokens of multiple
servers in a particular order. A related requirement is the token may be used
if certain environmental conditions hold. We introduce a secure
capability-based system that supports "permission sequence" and "context". This
allows a finite sequence of permissions to be enforced, each with their own
specific context. We prove the safety property of this system for these
conditions and integrate the system into OAuth 2.0 with proof-of-possession
tokens. We evaluate our implementation and compare it with plain OAuth with
respect to the average time for obtaining an authorization token and acquiring
access to the resource.
