# Issuing scoped credentials Request short-lived, task-scoped tokens, set a sensible TTL, and let rotation happen automatically. ## Request per task, not per session Issue a fresh credential for each task the agent takes on, scoped to exactly that task. Long-lived, broad tokens are the failure mode Mandavo exists to remove. The Issuance Engine mints the credential on demand and returns it once. Store it only in memory for the life of the task. ## Choosing a TTL Default time-to-live is five minutes. Match the TTL to the task: a quick read can live for seconds, a long batch job can request a few minutes and renew. Shorter is safer. A credential that expires before it can leak needs no manual rotation and no cleanup. ## Automatic rotation For long-running work, request a renewable credential. The engine rotates the underlying secret on a schedule while the task holds a stable handle, so nothing standing accumulates. Rotation events are logged and never interrupt an in-flight, in-policy action. ## Staying inside scope A credential can only be issued within the identity's declared ceiling, and can only be used within its own scope. Requests outside scope are denied at issuance and, if a token is misused, again at execution time by the policy graph.