Exactly, but this model permits a level of granularity (and full-guarantee revocation!) that NIP-26 could never ever dream of allowing.
I am now doing single use tokens; copy a single code (or scan a QR code) and an entire preset policy is set for that application! 🙌