I spent 7 days learning Solana token extensions. Here's what clicked, what surprised me, and the code you need to build tokens that can't be traded but can be revoked.

The Problem (In Web2 Terms)

Imagine you work in HR. You issue an employee a digital badge proving they're a certified security officer. Here's what you'd want:

The badge stays in their wallet — they can't trade or sell it

Only they can use it