GitLab project and group access tokens — mintable and revocable through the API, but with expiry that GitLab only accepts as a date. There is no such thing as a fifteen-minute GitLab token, so this engine keeps two clocks: it asks GitLab for the nearest possible date as a backstop, and holds the real deadline in the lease, where the reaper can enforce it to the second.
See docs/delegation/gitlab.md for the mechanism and
docs/delegation/setup/gitlab.md for the operator walkthrough.