Keycard Adds Fresh Auth to Temporal

Durable execution makes stale credentials a security boundary, not just an operational nuisance; Keycard addresses it at the activity layer.

• –Fresh per-attempt tokens reduce exposure from expired, revoked, or overprivileged credentials
• –`@grant` scopes each activity to the resources it actually needs
• –Keeping tokens outside workflow history avoids sensitive credentials appearing in Temporal’s UI and retained event data
• –Retries automatically reauthorize instead of replaying the same stale token
• –The integration is compelling for long-running agents, though it currently targets Temporal’s Python ecosystem and depends on Keycard’s hosted authorization service