machine create, list, revoke

kcap machine create <name> [--visibility private|org_public|public] [--role member]
kcap machine list
kcap machine revoke <service-id>

Requires kcap administrator rights and, for create, the organisation owner or admin role. The secret is printed once to stdout, everything else to stderr. --visibility only selects the value shown in the printed runner instructions. list gives the service id revoke takes; revocation cannot be undone. Full setup: Store sessions where nobody can sign in