Credentials stay hidden

Agents can use sensitive service accounts without seeing the underlying credentials.

Policies define access

Arbiter operators configure precise policies for what agents can do with each account.

Capabilities are discoverable

Agents get a structured capability API instead of ad hoc service access.