A governed claim check for Java: a token travels instead of the payload, and redeeming it is decided against the value's label, the sink's ceiling, and an identity the holder of the token does not control.