Introduce the notion of "RestrictedCredentials"; these are Credentials with a built-in specification to which they may be applied.

An example of this would be a credential that stores an OAuth token, which is an inherently restricted form of authority with certain built-in "scopes" that limit what it may be used to do.

Since DomainCredentials performs the actual requirement checking at the "Domain" level, this concept isn't something that could be easily introduced via a third-party plugin.