Rotating Credentials

A grant list names who may read the value; rotation needs who actually holds it. Permissions overstate it with idle standing grants and understate it with copies taken once, fleets behind one identity, and holders that never call the store.

A one-step swap has no instant at which every holder switches. The database stopped accepting the old password while running processes still held it, so their next connection failed. Safe replacement needs both values accepted at once.

What you can prove decides it, not what is likely. Unless you can establish that every copy on the device was unreadable to whoever now has it, treat the credential as exposed and replace it, then refuse the old value.

Writing a new value into the store is only half a replacement. The system that honours the credential was never told to stop accepting the old value, and every holder still presents it. Withdrawal is a separate action against a different system.

Scheduling removes the failures of the human step — skipped runs, mistyped values, steps out of order — and adds silent failure, a clock blind to context, and a standing privileged holder able to change credentials.

At most eighty-nine days of working access, and only because the old value was stopped from authenticating. A replacement cadence caps how long an unnoticed copy stays useful; it reverses nothing the intruder already did inside that window.

Read records are evidence of reads, not a register of holders. They miss anything whose cadence exceeds the observation window, anything that read once and still holds the value, machines hiding behind one shared identity, and copies living outside the store.

Silence in the store's read records proves nothing: a process that read the value at start-up never reads again. Confirm from the accepting side — which credential each connection authenticated with — or force every holder to re-read.

There are only two orders and each buys one thing at the other's expense. Withdrawing first ends the attacker's access now and costs every holder an outage; cutting over first avoids the outage and leaves a working credential in unknown hands throughout.

The run was closed when the store held the new value and the ticket was filed — neither of which changes what the export presents. Nothing moved the consumer, and nothing waited for the supplier's change, which landed six weeks later.

Three things: the census cannot see it, because it never reads the store; writing a new value does not reach it; and it keeps working until the old value stops being accepted downstream, then fails late.

Replace every value of yours that sat inside their estate: the credentials you issued them, anything shared through their support path, and any value pasted into a ticket. Credentials they issued you, they must re-issue — your job is accepting a new one quickly.

Four things from the downstream: a programmatic way to change the credential, an identity allowed to make that change, rules the generated value can satisfy, and a way to test the new value afterwards. Absence of any one forces a runbook.

A shared value turns replacement into one synchronised event with no partial progress: the old value cannot be withdrawn until the last holder moves, reads arrive under one identity so you cannot tell who moved, and failures afterwards are unattributable.

Long enough for the slowest legitimate holder to re-read and reconnect — usually set by the least frequent restart or batch run, and measured rather than guessed. No longer than that: until withdrawal the old value still authenticates.

Agreed triggers turn a judgement call made under pressure into a fact of record: the event is recognised rather than argued. Naming who may declare one without approval stops the single action that bounds the exposure from waiting on an escalation chain.

The path that let the first value out is a delivery channel, not a one-off event. Whatever carried the old value carries the replacement the same way, so the new credential is disclosed as soon as it exists.

Present the actual old value to every system that honours it and require a refusal, then record the time of the first refusal. A withdrawal command that returned success is a request that was accepted, not a result you have observed.

The four-year-old one, by a wide margin — and not because the value is old. Nobody has ever run that change, so the holders, the failure modes and the way back are all unproven, while the quarterly one has been rehearsed twelve times.

Enumerability is bought at issuance, not recovered later. A new credential is either observable — every consumer fetches it from the store, ideally one value each — or it carries a named owner and an agreed flag-day plan.

Create the overlap somewhere else, or accept a gap: move callers to a second account on that service, put one component in front that holds the credential for everyone, or take a short planned interruption with the callers quiesced.

Compute the cutover from the population and the update rate, then decide in advance who breaks. When the fleet is larger than the rate, no sequence gives both a dead old value and an unbroken fleet, and the window you buy is also the attacker's.

Rank by what an older value costs, not by what automates easily. Build one shared path for the programmatic half; for the portal half, buy the exposure down with narrower rights, fewer holders and a rehearsed runbook.

Answer the intent, not the number. Restate the policy as a bounded, demonstrable exposure window plus a replacement that has been performed at least once, classify the estate against that, and return a commitment with a named exception list rather than a yes or a refusal.

Nothing enforceable. A promise buys a record of what was seen and when, which scopes the replacement and sets the clock. Because no system holds the copy, there is nothing to revoke and nothing can confirm disuse — only replacement bounds it.

The live value is now lost and the two sides disagree. A re-run may be unable to authenticate to make a second change, may consume the account's only spare credential slot, or may trip lockout and reuse rules. Reconcile first.

Four things: the access that produced the copy is closed, the old value genuinely stops authenticating, harm accrues over the window rather than in one act, and detection is slower than the interval. Break any one and the cap is fiction.