Credential scope hardening
Additional service operations support narrower scopes for least-privilege integration.
- Inventory existing broad credentials
- Issue replacement credentials before revocation
- Test negative authorization cases
- Record owner, purpose, and rotation policy