Per request from @colourful-land we need to construct a new object called Capability Attestation, which can be used by Token Negotiator to preemptively fetch a token for a specific site.
We agreed that such an attestation would include the following fields:

1. Unique ID (big Integer)
2. Domain (URL)
3. notBefore (Unix time)
4. notAfter (Unix time
5. Capabilities (Integer or bit string. In the integer case each bit of the integer will represent a capability granted if the bit is 1)