The Missing Foundation of Non-Human Identity(hessra.net)

4 pointsby ymyms7 bulan yang lalu1 comments

The Missing Foundation of Non-Human Identity

https://www.hessra.net/blog/the-missing-foundation-of-non-human-identity

1 comments

ymyms7 bulan yang lalu

I’ve been working on an identity/authorization system for machines and kept getting stuck on a basic question: what is machine identity, independent of any one stack (Kubernetes, cloud, OAuth, etc.)?

This post proposes a simple model based on where identity originates (self-proven / attested / asserted), what privileges it has at birth, and how it lives over time (disposable vs durable). I’ve also mapped common systems like SSH, SPIFFE/SPIRE, API keys, IoT, and AI agents into it.

I’d be very interested in counterexamples, ways this breaks down in real systems, or prior art I’ve missed.