A decade ago I wrote the design doc for SPIFFE. Workload identity is finally having its moment.

In my experience leading engineering projects, I have encountered the same pattern repeatedly. We obsess over deployment speed. We measure success in commit velocity and uptime. But we rarely pause to ask the most uncomfortable question in the room: Who actually owns the identities we just spun up?

This silence isn’t malicious; it’s structural. We have optimized our entire software delivery…