vm-ops/20-identity/leases/op-witness-phone.md

Lease: op-witness-phone

Grant

• Lease type: device (witness)
• Issued to role: witness
• Issued at (UTC):
• Expires at (UTC):
• Revoked at (UTC):

Scope

• Permits: read-only verification and confirmations.
• Forbids: initiating critical operational changes.

Rotation / revocation

• Revoke: remove device access and rotate any linked factors.
• Verify: confirm no critical role can originate from this device.