Let's say you're creating a banking web application with mobile apps. A bank user has permissions "transfer money" and "view balances." When a user logs in, we can create a session token (typical random string, stored in the database on the server and in a cookie or device storage on the client) with "view balances" permissions that lasts 24 hours.
However, "transfer money" is more sensitive so we could create a separate session token that expires in only 1 hour. If a user visits the site again in 12 hours, they'd still be able to view their balances, but they'd have to re-auth with the backend to transfer money. Then, for the next hour they could transfer money at will.
Is it advisable to create multiple session tokens with different expirations and different capabilities that co-exist in the client application? Is there a better solution?