Really thorough rundown, especially the eight-way comparison table. One thing the short-lived-token tier doesn't quite resolve: Restock Agent runs unattended overnight and Tier 1 says swap the forever-secret for a short-lived token, but a token short enough to be a meaningful control surface won't outlive an actual overnight run, so something has to refresh it mid-task. If that refresh just re-issues the same scope without checking anything, you've bought token rotation and nothing else, the same standing authority is still alive, just wearing a new token every few minutes. The revocation you actually want, admin pulls the agent's access or the sponsor situation changes, only does anything if the refresh step re-runs the authorization decision rather than rubber-stamping the previous one. Worth being explicit about which of the two you're buying when picking a TTL, since "short-lived" reads as a security property but is only one if the refresh path checks something new each time.