Detect an API's credential issuer

Status: Accepted. Date: 2026-09-30. Card t_ad153e0a, tasks t_78502407 and t_c46588a4.

Web Risk's SDK obtains an access token through Google OAuth using Application Default Credentials. Detecting only the Web Risk SDK omits the credential issuer; treating GOOGLE_APPLICATION_CREDENTIALS as ordinary app config can copy a real credential file path from an example into the World.

An API descriptor may name its credentialIssuer, another pack of that vendor. Detection expands that declared relationship and explains it in the vendor report; selection remains the operator's. Credential-door fill names also detect their issuer exactly, without relying on suffix heuristics. A credential file path without a selected issuer becomes a disposable missing path, never the example's real path.

Web Risk verifies issued tokens through the kernel's existing owner-store projection, exposed to derived handlers as ownerRow over the manifest's allowed ownerReads pairs, and checks its spec's OAuth scopes. Revoked, expired and invalid issued tokens are refused. A standalone World may state an external token through a door, where the API cannot create one itself; it carries its grant and expiry. No unconfigured issuer produces an authenticated success. The architecture's descriptor section owns these fields.