The useful question for a permission gateway is what happens when an agent tries the next thing. Tokening.net now has two measured case studies: a WordPress edit bounded by post, fields, use count and deadline, and two simultaneous calls competing for one remaining use. They describe the disposable Docker demonstration and published release tests, rather than invented customer deployments.
Two additional guides show how to apply the current permission model. An editorial workflow issues a short-lived grant for one article without handing over the WordPress account credential. A REST maintenance example binds a record path and permits a bounded note field. These are illustrative deployment patterns, with explicit limits around adapter argument shapes, nested JSON and uncertain upstream writes.
The demo page also has consistent tokening.net branding and a replay contained within the site article width, with the usual navigation and footer. The project remains one self-hosted Go binary with SQLite storage, under Apache 2.0. Operators must keep the real upstream credential and admin listener outside the agent environment; a task grant cannot prevent a bypass through credentials the agent already holds.