def verify_capability(token, action, resource, now, used_nonces):
    return {'allowed': ..., 'reason': ...}

1. reject replayed or expired tokens
2. match the exact action
3. confine resources to the token prefix

• Use only the Python standard library.
• Return deterministic values so every run can be compared with the contract.
• Do not mutate caller-owned inputs.