Federation (shape E) — the engine that deliberately issues nothing.
Under federation the provider is configured to trust the consumer's own identity, so no credential is minted, brokered, stored or handed over. What a consumer needs from us is not a secret but an answer to "where do I exchange my own token, and what must that token say?".
That makes this engine a directory rather than a vault, and it is the
strongest outcome available: there is no root credential to compromise and
no leased credential to leak. See docs/delegation/federation.md.