Engineering / advanced
Identity from bootstrap to revocation
Trace workload authentication and authorization through bootstrap, issuance, token boundaries, rotation, and recovery from compromised credentials.
Your route through engineering
Follow the path or begin with a question. Every lesson is open.
Your place, at your pace. Progress is optional and saved only in this browser when available.
Read / explore / reason
Inside this module
Module 01 advanced
Identity from bootstrap to revocation
Trace workload authentication and authorization through bootstrap, issuance, token boundaries, rotation, and recovery from compromised credentials.
- 01
Trust domains and names that identify principals
Bind workload names to an authority before using them in policy or audit records.
24 min - 02
Bootstrap without circular trust
Trace the initial authority and platform evidence that let a workload obtain its first credential.
25 min - 03
Attestation evidence and bounded issuance
Match trusted attributes to an identity without claiming that a credential proves every aspect of runtime integrity.
25 min - 04
Short lifetimes and a working renewal path
Balance bounded credential validity with issuance capacity, clock uncertainty, and control-plane outages.
25 min - 05
Audience binding and constrained delegation
Prevent token substitution and confused-deputy access by preserving recipient and caller authority boundaries.
26 min - 06
Identity proof and resource decisions
Evaluate who called separately from what that caller may do to a particular resource.
24 min - 07
Policy composition belongs to a specific engine
Reason about grants, boundaries, and explicit denies without assuming one provider's combination rules are universal.
26 min - 08
Federation preserves authority boundaries
Authenticate foreign identity authorities and map their subjects without silently merging namespaces or permissions.
26 min - 09
Revocation reaches the verifier later
Bound new-request rejection only after accounting for status publication, verifier caches, expiration, and existing sessions.
27 min - 10
Recover the authority and drain old trust
Plan compromised-identity recovery across issuance, roots, caches, tickets, and active sessions with verifiable cutoffs.
28 min