Personal access tokens with prefix, scopes and last use; a read-only identity panel sourced from the cockpit; and the token revocation-lag notice.