An organization would like to use a scheduler to track & revoke access granted to a job (by Vault) at completion. What auth-associated Vault object should be tracked to enable this behavior?

A Token Accessor is a non-sensitive, publicly safe identifier for a Vault token, allowing external systems like schedulers to perform management operations such as lookup, renewal, or revocation on the associated token without needing access to the sensitive Token ID itself.

The Token ID is a sensitive credential that, if exposed to an external scheduler, could grant unauthorized access to Vault.

A Lease ID is associated with a specific secret or credential lease, not directly with the token that grants overall access to Vault.

An Authentication method is the mechanism used to authenticate and acquire a token, but it is not a trackable object for revoking specific access grants.