Credential lifecycle and rotation

Model credentials as authority with a lifecycle, not configuration strings that can be copied between components. Inspect the identity provider's documented protocol, repository auth/storage adapters, consumer lifecycle and key custody. Apply secrets-safety; inspect metadata and references instead of revealing values.

Define identity and authority

Distinguish operator identity, service/worker identity, enrollment proof, short-lived access authority, renewable credentials, and target-system secrets. Record audience/origin, principal and tenant scope, allowed actions, expiry, revocation behavior, storage owner and recovery authority for each.