Arsenal capability and credentials
Connect an agent to provider access through explicit policy and custody.
Arsenal provides capability tokens, credential storage, policy evaluation and a broker proxy. The supported source modes include proxy-oriented credentials and wrapped-secret delivery; select the mode appropriate to your custody boundary.
A route's required scope belongs to server policy. An incoming token must not choose its own authorization requirement. Configure issuer/audience/key trust and tenant identity before evaluating the requested provider access.
The unified TypeScript facade adapts an ArsenalClient and exposes a CredentialHandle. Handle refresh is explicit and returns a new handle. Broker HTTP endpoints and lifetime defaults belong to the actual broker configuration, not a universal SDK-wide timer.
See the credential workflow, routes, ACT format, and handle lifecycle. Payment signals, consent channels or automatic grants require a separately configured integration; they are not implied by installing the facade.