Workload identity and least privilege

A workload identity represents a service under a particular deployment policy, rather than a human's reusable login. SPIFFE specifies identities within trust domains and verifiable documents used by workloads. Kubernetes service accounts similarly provide a machine identity within its API authorization system. The issuance mechanism must connect the identity to the intended workload; merely possessing a claimed service name in a request is insufficient.

Separate issuance, authentication, and authorization in your diagram. Issuance decides which running process receives credentials. Authentication verifies a presented credential and its intended audience or peer. Authorization evaluates the requested action against policy and current resource ownership. A valid training-job identity should not automatically become an administrator of the registry, object store, and secret service just because these systems cooperate in one pipeline.

Short-lived credentials reduce the time a stolen credential remains usable after issuance, assuming renewal is denied to the adversary. They do not help if a compromised workload can repeatedly obtain replacements. Protect the workload API, validate audience and expiry, rotate trust material safely, and test revocation behavior. Avoid placing bearer tokens in model prompts, retrievable documents, or routine logs, where another component may inadvertently disclose them.

For an assistant's tool call, derive permission from the authenticated user and a narrowly scoped service policy. Do not accept a user identity invented by generated text. Bind approval to the concrete resource, operation, and important parameters, and recheck when executing. A confirmation for sending one document must not silently authorize an entire folder after a retry or a changed model proposal.

Credential lifetime trades exposure against renewal traffic and tolerance of temporary issuer outages. If theft time is uniformly distributed across a fixed validity window, mean remaining lifetime is half that window. This is a planning model, not an attacker guarantee: theft may occur immediately after issuance, clock skew matters, and cached sessions can outlive the credential unless their own policies constrain them.

Least privilege also reduces consequences when identity fails. Use separate read and publish identities, restrict registry prefixes, limit egress destinations, and grant temporary elevated access through an audited workflow. Test denied operations as well as successful ones. Monitor renewal failures without exposing credentials, and keep an emergency path whose use is visible, time bounded, and followed by review rather than permanently broadening every service account.