workload identity

Leaked keys remain one of the commonest breach causes, and agents create new places to leak them. The scored answer prefers no secret at all, then short-lived ones, and keeps them out of every model context.

mTLS authenticates both ends, but only as well as your private CA and identity scheme. The scored answer designs issuance, identity, rotation and authorisation, and contrasts it with the public web.

Issuing a certificate is easy. Knowing every certificate you issued, renewing them before they expire, and surviving the day a CA key leaks is the design.

Static API keys in environment variables are the most common credential leak there is. The answer is platform-issued, short-lived, attested identity.

Moving passwords from config files into a secret manager helps only if the application's way of logging in to the secret manager is not itself a password in a config file.

Serving nodes parse hostile input all day, so assume one falls. The design question is what it can reach: the registry, other tenants' models, the signing keys, or nothing at all.