What we shipped, in plain language.

Scoped issuance now supports per-call constraints. An agent can hold a credential that only works for one resource, one action, for the next 90 seconds. Standing keys keep shrinking.

We cut anomaly-to-revocation from 6.1s to 4.2s by moving policy evaluation next to the issuance path. Full write-up on the kill-path and the audit trail behind it.

Reached zero standing keys across our whole agent fleet this week. 340 agents, every one sponsor-bound, no long-lived secrets left. Mandavo made the cutover boring — which is exactly what you want.

The Agent Identity Directory now discovers shadow agents automatically. If something is calling your APIs without a record, you'll see it — with a suggested sponsor and scope to onboard it.