Offboarding, once
When somebody leaves, their access is scattered: standing grants, group memberships, resources they own, API keys, agents acting for them. Finding all five by hand is how an orphaned key survives a departure by a year.
The offboarding sweep enumerates every hold from the three sources that each see a different slice — the PDP, the catalog and the credential store — plans the revocation, and runs it behind an approval gate. A certificate records what was revoked.