Your store now mints accounts in a reporting warehouse — why is the store's own identity there more dangerous than any credential it hands out?

## The identity that makes minting possible Per-consumer issuance is not magic performed by the store. It is the store, holding a standing identity in the downstream system, performing create-grant-remove on demand. That identity is the hinge of the whole design, and it has three uncomfortable properties at once: - It is **standing** — it exists between requests, not only during one, because the store must be able to serve the next consumer that starts. - It is **privileged** — on most systems, creating a principal and attaching rights to it is an administrative capability, not an ordinary one. - It is held by a **network service** that every consumer in the estate talks to, which is a far larger attack surface than a credential sitting inside one job. ## Why it outranks everything it hands out | If this is compromised | What the attacker holds | |---|---| | One minted consumer account | That consumer's rights, on that dataset | | The store's identity in the warehouse | The ability to create principals with any rights it may grant, repeatedly | The second row has properties the first does not. New principals it creates look exactly like ordinary issuance, because that is what ordinary issuance looks like. They can be created under names that match the estate's convention. And the capability persists: removing one abused account does not remove the ability to make another. There is a second, quieter asymmetry. A leaked minted account is bounded by the rights that account was given, which you chose. The minting identity is bounded by the rights the **system** will let it grant, which you may not have chosen at all — and if the only way to get create-and-grant in that system was an unrestricted administrator, then the design has quietly traded a shared read credential for a standing administrator. ## Bounding it 1. **One identity per downstream system.** A single credential that mints in five systems makes one compromise reach five. Separate them even when the store is the same. 2. **Grant the ceiling you want, where the system offers one.** Some systems enforce that a grantor may hand out only rights it holds itself. Where that is true, holding a deliberately weak minting identity makes it structurally impossible to mint anything stronger, whatever the store's rules say. Where the system does not enforce it, you have no ceiling and the narrowness of every account depends on the store's rules being right, so the rules deserve the review effort the ceiling would have saved. 3. **Do not give it rights to the data itself** where the system allows creating and granting without reading. This is not universally possible, but where it is, it means a compromise of the minting identity is a route to access rather than access itself — which costs the attacker a visible step. 4. **Watch principal creation in the downstream system's own records**, not only in the store's. The store's records say what it was asked to do; the system's records say what was actually created there, including anything created by some other route. 5. **Alarm on shape, not only on volume.** A created principal whose rights fall outside the template the store is supposed to produce is a strong signal, and a cheap one. ## The severing question An incident plan should state, before the incident, what happens when you cut the store's identity out of that system. Two things are true and are commonly confused: - Removing the minting identity **stops new issuance immediately**: no consumer can obtain an account there until it is restored, so anything that restarts during the window fails to start. - Removing the minting identity **does not withdraw accounts already minted**. Those are ordinary principals of the warehouse now; ending them is a separate action against the warehouse. Both sentences are worth saying in an interview, because the instinct under pressure is to assume that cutting off the minter also cuts off everything it made. It does not. And the cost of the first sentence — an estate that cannot obtain downstream credentials for the duration — is precisely why the decision belongs in a plan rather than in the moment. ## The judgment this demands The honest summary is that per-consumer issuance moves risk rather than deleting it. It removes a long-lived shared value that was sitting in several places, and in exchange it concentrates a privileged identity in one service. That is usually a good trade, because one privileged identity in a system you monitor is easier to defend than a shared value you cannot find every copy of. It is only a good trade if the concentration is acknowledged, scoped and watched — and if you could answer, today, which downstream systems your store can currently create principals in.