GitHub App installation tokens — the one provider in this set where a lease means exactly what it says: credentials are short-lived by construction, narrowable to named repositories and a subset of permissions, and genuinely revocable before expiry.
See docs/delegation/github.md for the mechanism and
docs/delegation/setup/github.md for the operator walkthrough.