# Lease: <device-or-system>

## Grant

- Lease type:
- Issued to role:
- Issued at (UTC):
- Expires at (UTC):
- Revoked at (UTC):

## Scope

- What this lease permits:
- What it explicitly forbids:

## Rotation / revocation

- Revocation procedure:
- Post-revoke verification:

## Evidence

What you record when granting/rotating/revoking (timestamps, IDs, logs).