The org chart is a token tree, and the leaves can't reproduce

IT holds one root token with resources.create_tokens. From it, each team lead gets a child token: clamped to a subset of the root's permissions, realm-restricted to their team's containers, delegation_depth 1. Each lead mints their engineers' tokens with deny_reauthorization: true: the permission to create tokens is stripped, so an engineer's credential is a leaf. It can deploy; it cannot spawn.

GET /api/v1/auth/tokens from the root lists the whole subtree, each entry with last_used_at and last_used_ip. When an engineer leaves, their leaf is one DELETE, and nothing below it exists to clean up.

A credential system usually needs a directory, a secrets manager, and a spreadsheet of who has what. Here the delegation chain is the permission model: nobody can hand out more than they hold, and the last link can't hand out anything.

The org chart is a token tree, and the leaves can't reproduce.