How the engine reacts when a credential's ExpiresAt has passed.
'block' — refuse to hand out the credential; getCredential() throws
CredentialExpiredError. This is the default and matches the
documented contract of the Credential.ExpiresAt column ("Expired
credentials are treated as inactive").
'warn' — hand the credential out anyway, but mark the result as expired
and emit a warning. Intended as a temporary escape hatch while an
organization cleans up stale expiry dates; it is NOT a safe steady state.
How the engine reacts when a credential's
ExpiresAthas passed.'block'— refuse to hand out the credential;getCredential()throws CredentialExpiredError. This is the default and matches the documented contract of theCredential.ExpiresAtcolumn ("Expired credentials are treated as inactive").'warn'— hand the credential out anyway, but mark the result as expired and emit a warning. Intended as a temporary escape hatch while an organization cleans up stale expiry dates; it is NOT a safe steady state.