Comment by talkarimli

agreed, ttl alone is weak. but brokers get hard with google oauth. scopes are coarse and the agent acts as the user. how does plimsoll handle refresh tokens?