Building a Federated Copilot: Part 3, Consent, Revocation and Vault

Persist grants, authenticate policy callers and move signing into Vault without confusing device sessions, human approval and agent authority.