Agent keys

One credential per agent, revocable on its own.

AgentKeyRoleStatus

Issue a key