The Nature of Secrets

If disclosing a value lets someone act with rights you hold, it is a secret; if it only tells the process where to go or how to behave, it is configuration. Being sensitive is not the test.

Withdrawing a fleet-shared credential stops every holder at once, not just the compromised host: several hundred collectors fail together. Sharing traded per-host containment for one estate-wide switch, so containment and outage became the same action.

Shortening validity caps how long an undetected leak stays usable: a copy of a one-hour credential found in a log next week is inert, while the four-year one still works. It changes nothing about the minutes an attacker already had.

A usable row names the credential, the system it authenticates to, its class, where the value of record is held, a single accountable owner by name, when it last changed, and the copies known to rest outside the store.

Generation is a capability of the system that accepts the credential, not of the store. The warehouse must expose an interface to create and drop accounts on demand, a privilege template to stamp them from, and a collision-free naming scheme.

Both prove possession and nothing more. The shared password says the caller is that account, with the account's whole set of rights; the bearer token says the caller holds a value issued to one consumer, carrying only the rights attached when it was issued.

Each axis cuts a different dimension of the same radius. Environment bounds which systems a leak reaches, holder bounds how many callers one withdrawal stops and who the record can name, and right bounds what any holder can do. Cutting one leaves the other two at full width.

An access record can only name what the caller presented. When several hundred collectors present one value, every entry carries that same identity, so the record proves a credential acted and can never say which of its holders acted.

Expiry only stops future use of a value. The data already read, the account already created and any credential minted with it survive it. And a shorter setting binds the next credential issued, not the copy already out there.

Ownership was never recorded anywhere. What exists instead is a set of readers who each need the value and none of whom has authority to change it, so ownership has to be conferred by decision rather than discovered by investigation.

Static and generated describe how many consumers hold one value, not how the characters were produced. A value read by everybody is static however random it is; a generated one is created per consumer that asks.

Compound values: a connection string with the account password inside it, a callback link whose query value is the whole permission, a join value that admits a new node, a header template holding a token. Classify the value, never the key name.

The floor is set by the longest period any holder keeps one value with no way to obtain another: a six-hour export, a pool whose connections authenticate once at open and live for days, a worker that reads at boot and holds until redeployment.

Reconstruct what was reachable, not what was read. Enumerate the repositories, channels, ticket queues, runbook pages and hosts their accounts could reach, work out which values were visible from each, and interview them and their teams before Friday.

Only half the mechanism was built. Minting ran on every request and nothing ever dropped an account once its consumer was gone, so generation replaced one credential to look after with a growing population of real, still-valid accounts.

A disclosed signing key lets an attacker produce values the system accepts as genuine from now on, and drains the evidential value of everything already signed. A disclosed data encryption key lets them read any copy of the ciphertext it protected, including copies already taken.

Not as the first move. Cut what the exposed value may do at the destination, which takes minutes and stops no collector, then push the replacement, then withdraw the old value once nobody is presenting it - with a deadline after which you accept the outage anyway.

Two measurements decide it: how long a leak goes unnoticed here, and the longest holder that cannot obtain a fresh value mid-run. Shortening pays hugely from years to days to hours, then flattens — below that you trade availability for a narrow band.

Cut at the unit you would actually act on. If you would never take one collector offline without taking its whole site offline, per-site identity gives most of the containment for a fraction of the identities, and per-host granularity is paying for a distinction you will never use.

Every entry inherits credential handling, so a page size earns an approval and a hostname earns a replacement runbook. Attention drains from the entries that genuinely grant authority, and the friction pushes people into keeping easier copies outside the process.

Make the row a precondition rather than a report: no credential enters production without an owned row, attach rows to the ownership records teams already maintain, and make periodic re-confirmation ask questions instead of requesting a tick.

Exempt on a mechanical test, not on how sensitive a system feels: whether it can create and drop accounts without a person, and whether it can hold one identity per consumer. A supplier issuing keys only through its portal fails permanently.