Google Cloud credentials — service-account impersonation, downscoped Cloud Storage tokens, and HMAC keys.
GCP can mint short-lived credentials and, uniquely among the clouds here,
can narrow one to a single bucket and prefix at mint time via a Credential
Access Boundary. What it cannot do is revoke one: an issued access token is
valid until expireTime no matter what happens in IAM. So the headline
shape is B — scope and TTL are the whole containment story — with HMAC keys
as the one genuinely revocable option.
See docs/delegation/gcp-storage.md for the mechanism.