Ephemeral credentials issued only when needed for a task and scoped to minimum privileges and short expiration.