DL-593

Saiph tokens are JWTs with iss, sub, aud, tenant, scope, exp and iat, at most one hour long; keys are discovered from the issuer URL; Kubernetes service-account tokens map to service:k8s// in Issuer.Tenant; Compass mints ES256 tokens for agents, humans (device grant) and itself.

Status: Active (design, 2026-10-19)