Topic
A security model that assigns verifiable, short-lived cryptographic credentials to non-human callers like services and agents, replacing static secrets.
Front Door, API Management and private networking cost about $1,730 a month in West Europe in a dev.to Container Apps reference stack for .NET. With the .NET compute at $20 to $140 a month, the risk sits in the hand-offs between its layers.
Reality
Trusted publishing swaps a stored npm token for a short-lived OIDC one, and it needs npm CLI 11.5.1, Node 22.14.0 and a hosted runner. The CLI falls back to the old token whenever the OIDC path is absent.
Reality
RuntimeWire's comparison of two shipped Codex desktop builds found a second cloud path whose new environments start at package-manager network access, then take on Tailscale keys, proxy-delivered secrets and OIDC cloud identities.
Reality
AWS ends App Mesh support in September 2026. One team scored the replacements on weighted criteria, wrote a rollback for every step, and moved about 40 services in two phases with no outage.
Reality
The spec's own boundary list says a verified catalog entry establishes which domain claims a capability and what trust material it published. It says nothing about whether the calling process is the agent it names.
Reality
Unit 42 showed that spoofing the cgroup data a SPIRE agent reads during workload attestation makes it hand over a co-located workload's SVID, and released a tool so defenders can size the loss per node.
Reality
The ext-auth repo holds two files: a stable extension that authenticates a person through an IdP redirect, and a draft machine flow that hands the agent a pre-registered key it has to keep. Both agent-identity proposals are open.
Reality
The v1.37 GA puts X.509 delivery and refresh inside Kubelet, but the authority that actually signs those certificates is still integration work, which is why no adjacent tooling comes out of the plan this quarter.
Reality
KEP-4317 pairs a pod-scoped certificate request with a projected volume, so the kubelet provisions the key and kube-apiserver enforces node restriction. What is left for a signer to do is the CA work.
Reality
Red Hat's pitch for SPIFFE and SPIRE on OpenShift is an argument about exposure windows: a leaked Secret stays valid until someone notices it. Agents sharing the analysts' database worsen the arithmetic.
Reality