A blanket quarterly rotation policy lands on your platform team, whose estate ranges from per-request minted credentials to values untouched for years — how do you answer?

## Do not answer the cadence; answer the intent A blanket interval is a proxy someone reached for because the property they actually want is hard to state. Two properties sit underneath almost every such policy: - a **bounded, demonstrable window** in which an unnoticed leak of a credential stays useful; and - **confidence that a credential can be replaced** when something forces it. Saying that out loud is the whole move. A team that argues about ninety days loses either way: agreeing produces work with no defensible benefit on much of the estate, and refusing produces a team that looks like it is dodging the control. Restating the intent lets you be measured against something you can actually deliver and prove. ## Classify the estate before committing to anything | Class of credential | What a quarterly tick buys | What to commit to instead | |---|---|---| | Minted per consumer, expiring on its own far sooner | Nothing; the bound is already tighter | Report the bound it runs at, as evidence of intent met | | Long-lived and shared, with a rehearsed replacement | A modest exposure reduction | An interval derived from detection speed and change cost | | Long-lived and shared, never once replaced | Unknown, because the change is unproven | A first replacement, treated as discovery, sequenced by what it reaches | | Accepted by a downstream that will only take one value at a time | Exposure reduction at the price of an outage each time | Either the work to make the change cheap, or a longer interval with the reason recorded | The third row is where the real programme lives, and the fourth is where the honest negotiation happens. Note the sequencing criterion for the third: order by what each value reaches if it leaks weighed against what the change costs, not by which one is oldest — age makes a satisfying sort key and a poor risk ranking. ## What to hand the policy owner Give back something more checkable than the thing you are declining, or the exchange reads as evasion: 1. **Every credential has a named owner.** Without this the rest is unenforceable, and the class-three list cannot even be built. 2. **Every credential has a stated maximum age**, chosen per class rather than per calendar, and recorded with the reasoning. 3. **Every credential has been replaced at least once inside that period** — the clause that converts the policy from a date into a rehearsal, and the one that actually reduces the chance of a bad day. 4. **Exceptions are listed, with a reason and a review date.** An exception someone signed is a managed risk; an exception nobody wrote down is indistinguishable from neglect when an external audit asks how often the value changes and who can prove it. ## Say the cost out loud The part most teams skip is the price of the thing they are agreeing to. Each scheduled replacement is a production change with a non-zero failure rate, and on a large estate a quarterly rule is a standing workload. State it: the number of changes per year, the classes that carry outage risk, and what engineering effort would be needed to make those cheap. A policy owner who hears a number can trade; one who hears only resistance cannot. Be equally clear about what no cadence buys. It is not detection, it does not contain an intrusion that has already happened, and it is not a substitute for narrowing what a credential can reach — a value replaced four times a year that grants far more than its consumer needs is a worse position than a rarely-replaced value scoped tightly. ## Where this goes wrong - **Refusing with no alternative.** The policy exists for a reason; a refusal without a commitment loses the argument and the credibility. - **Agreeing and quietly not doing it.** The worst outcome, because it produces a documented belief that the estate is rotated and no rehearsal at all. - **Letting the cadence become a ritual.** Runs that touch values nothing consumes satisfy the calendar and rehearse nothing; they should be recognised and retired. - **Extending short lifetimes to match the cadence** so that one rule covers everything. This makes the estate's exposure worse in the name of consistency and is the clearest sign the intent was never understood. - **Treating the first run's value as exposure reduction.** For a never-replaced credential the first run mostly buys knowledge, and setting that expectation protects the programme when the first run is expensive.