A 24-hour token on a 90-second pod: why quarterly identity reviews cannot reach it

Convert the exposure window into a fraction and the argument stops being about governance maturity. A 24-hour token consumed by 90 seconds of work sits unattached for 86,310 of its 86,400 valid seconds, which is 99.9 per cent of its life as a bearer secret with nothing running behind it ^[13].

The residue is also where the scworld.com example wobbles. Subtract 90 seconds from 24 hours and you get 23 hours 58 minutes 30 seconds, not the 23 hours 50 minutes the piece quotes; that second figure belongs to its other worked case, the container that runs for 10 minutes ^[14]. The slip is small and it is instructive. The window is fixed the moment the token is signed, by the granted TTL and the job's actual duration, and nobody working a quarterly calendar is positioned to notice either value.

A review can do two things to a standing grant: renew it or withdraw it. Both need a holder. The piece is explicit that the model assumes the identity holder still exists to be reviewed ^[8], and that pod-level credential management is what traditional service account governance does not reach at scale ^[7]. What remains reviewable is not the pod. It is the rule that decided a pod of that class may hold a database credential, and for how long.

The cadence gap is arithmetic rather than diligence. A 90-day cycle spans 86,400 consecutive 90-second pod lifetimes ^[15], and the 90-day certificate rotation interval is roughly 39 million times the 200-millisecond runtime of the serverless function the same piece cites ^[16]. Scale pushes in the same direction: one deployment spinning up hundreds of containers across a day, each needing credentials for databases and APIs ^[6], and a monolith's single service account replaced by dozens of service-to-service relationships once it is decomposed ^[5].

SPIFFE is the honest end of this, with SVID lifetimes measured in hours rather than months and validity aligned to workload lifetime ^[12]. But "aligned" is doing quiet work there. A one-hour SVID issued to a 90-second job still leaves 58 and a half minutes of live credential behind it, 97.5 per cent of the certificate's life ^[17]. Shorter is a comparative. It becomes a control only when someone writes the number down per workload class and the issuer refuses to exceed it.

Which suggests the reviewable artefact for machine identity is a distribution rather than a roster: granted lifetimes plotted against observed workload durations, with the gap as the finding. That question can be put to an issuer's configuration at any hour of any day, and it does not require the workload to still be breathing when it is asked.