Your estate runs batch jobs longer than the validity window of the credentials they hold — what standard do you set for them?

## Restate the problem so it has a solution 'Jobs that run longer than their credentials' has no fix, because you cannot make a six-hour job shorter by policy. The version that does have a fix is: **no single unit of work may outlive the credential it holds.** That reframing is most of the value of the standard, because it moves the requirement from the job's total runtime — which is set by data volume and which you do not control — to the unit size, which is a design choice. A job of any length then becomes legal: it is a sequence of units, each comfortably inside a window, with a re-resolve and a reconnect at each boundary. ## The three moves, and what each costs | Move | What it actually fixes | What it costs | Where it stops | |---|---|---|---| | Shorten the unit; re-resolve and reconnect at the boundary | any run length, permanently | making units restartable and checkpointed — real engineering in each job | jobs with a genuinely indivisible unit | | Put the pair in a shared client every consumer uses | most consumers, without per-team work | you own the client, the rollout and the migration | a consumer that hands the value to a separate process or a client you do not control | | Ask for a longer window for this class of consumer | tonight, and buys time | a wider exposure, and a change to the issuance contract owned by whoever sets it | it postpones rather than removes the failure | The third belongs in the plan as a **bridge**, honestly labelled. It is not yours to grant, it trades a security property for an operational one, and a standard that quietly leans on it has chosen a longer-lived credential across the estate without saying so. ## What the shared client can and cannot reach This is where most versions of this standard are over-claimed. A shared client fixes a consumer that asks it for the value and lets it own the sessions. It does not fix: - A consumer that reads the value and **passes it to a separate process** it starts — a child process, a sidecar task, an external tool invoked once per run. - A consumer that hands the value to a **third-party client library** which captures it at construction and offers no way to replace it. - A consumer that **renders the value into a file or an environment** at start-up and never looks again. - Anything whose session is **established by a component you do not own**. Name those categories in the standard and require them to be declared, because they are exactly the population that will produce the next incident. Whatever their count is, it is the honest measure of how far the shared client actually reaches. ## Writing the rule so it can be checked A standard nobody can evaluate is advice. Make each clause checkable: 1. **A unit of work must be no longer than a stated fraction of the shortest window a consumer of this class can be issued.** State the fraction and state the shortest window you assumed — if the shortest is one hour and the fraction is a quarter, units run fifteen minutes. 2. **Each consumer must emit, at resolve time, the moment its credential stops being valid**, and, at each checkpoint, its remaining work. 3. **Each consumer must re-resolve and re-authenticate at a unit boundary**, with the error path as a backstop rather than the mechanism. 4. **A consumer that cannot comply must declare itself**, with the reason and an owner. Clause 4 is the one that makes the standard survive contact. There will be non-compliant consumers; a register of them is worth more than a rule they silently ignore. ## The judgment call you are actually making Underneath the mechanics is a choice about which failure you prefer. Small units mean frequent, cheap boundaries and the occasional restarted unit — a job that stumbles. Large units mean a smooth run that, when it collides with a window, loses hours of work — a job that dies. The first is worse on any given quiet night and enormously better across a year. The second judgment is whether the rule is uniform. A single fraction across the estate is easy to state and will be wrong for the extremes: it over-constrains a job whose natural unit is seconds and under-serves one whose indivisible unit is an hour. Per-class rules are more honest and cost you the classification. Either is defensible; choosing without saying which you chose is not. ## How you know it worked Count three things, monthly: consumers whose longest observed unit exceeds the rule; consumers emitting no resolve-time expiry at all; and declared exemptions. A standard whose exemption list is growing has not been adopted — it has been routed around.