Zero Trust Engineering — Non-person and workload identity lifecycle

/02 About

Identity and access engineering reference for non-person and workload identity lifecycle, including policy, logical interfaces, recovery and assurance.

Purpose: Non-person and workload identity lifecycle. Domain: Identity and access. Family: lifecycle. Scenario trigger: Register machine principal with accountable owner. Input assurance: Workload provenance and deployment identity attestation. Evaluation: Validate ownership and workload provenance. Governing policy: Machine principal issuance and deprovisioning policy. Resource-side obligation: Create restricted and revocable workload identity. Protected concern: Workload service identity register. Logical interface: Machine workload identity registration attestation and lifecycle event. Evidence: Enrollment ownership issuance and deactivation trail. Failure: Orphaned workload identity or inconsistent ownership. Required recovery: Quarantine identity and require provenance reassessment. Architectural invariant: Every non-person identity requires ownership, scope and revocable lifetime Adoption: replace reference roles with concrete owner-controlled services. Specify exact provider/consumer identities, schema fields and classifications, signal provenance and freshness, idempotency, authorization lifetime, timeout/retry limits, observation and tamper evidence. A denied or failed operation must not silently become a permitted one. Scope: original vendor-neutral, implementation-agnostic technical reference model. Illustrative logical components and behaviors are neither a deployed system nor evidence of regulatory compliance. Package identities remain stable within the package; cross-package semantic reconciliation requires separate explicit registry support.

Curated · other · unspecified · Published by Lattix · 29 elements · 34 relationships · validated on publish