Microsoft 365 / Graph app-only access tokens.
Microsoft is the provider that can be operated with no stored secret at all — a federated identity credential on the app registration lets a workload's own OIDC token stand in for a client secret. It is also a provider whose issued tokens cannot be revoked, so the containment story is entirely TTL plus resource-level scoping.
See docs/delegation/microsoft-365.md for the mechanism and
docs/delegation/setup/microsoft-365.md for the operator walkthrough.