Service-account grants

Service-account grants — contract and behavior

• A machine presents a grant minted by token-mint; only the grant hash is retained on disk.
• Grant scope binds the service to allowed items, fields, or operations rather than the whole vault.
• Plain grant material is shown only at creation and must move directly into the workload's protected configuration.
• Revoking or rotating a grant does not require reissuing human recipient keys.