The integrating developer decides whether the platform gets adopted at all; the security engineer decides whether it keeps its customers after an incident.
The platform service owner is an actor, not an implementation detail: the verification library is a product with its own adoption problem.
The scanning partner is an actor the platform does not control and cannot authenticate, which is why its interface is one bit wide.
What the goals reveal
"Prove the old one is idle before I kill it" is why last_used_at exists, and why it may be lossy — it informs a human, it does not authorise anything.
"Know how stale my answer is" is a requirement on the response shape, not on the documentation.
"Tell me what it did before I did" is why audit retention outlives the credential by years.
Deliberately absent
No "administrator" actor. Every privileged action belongs to a named principal in a tenant, and platform support is modelled explicitly as someone who cannot read secrets.
