An X.509 extension that scopes certificates to specific purposes like server auth, client auth, or code signing.