The Rotation Tradeoff

## The one quantity the arithmetic gives you A fixed replacement cadence produces a single arithmetic result: an upper bound on how long a copy of a credential that somebody took **without your knowledge** goes on authenticating. In this scenario the copy was taken on day 1 and the old value stopped being accepted on day 90, so the intruder had **89 days** of working access. It is worth being precise about what kind of number that is. - It is a **ceiling**, not an expectation. A copy taken on day 80 gets a ten-day window from the same schedule. If a theft is equally likely on any day of the interval, the average window is near half of it — the cadence guarantees the worst case and only influences the average. - It bounds **future** use, measured forward from the moment the old value stops working. Nothing about it reaches backwards. - It exists **only because the old value stopped being accepted**. A new value written beside a live old one bounds nothing at all. - It says nothing about **detection**. A cadence is the control you are left with when detection failed; had the misuse been noticed on day 2, the schedule would never have entered the story. A cadence has a second product that is not arithmetic at all — a replacement path that has actually been exercised — and that is a separate subject from the ceiling this question is about. ## What the intruder keeps This is where most candidates overstate the benefit. The replacement ends the credential's usefulness going forward and does nothing else. | Bounded by the replacement | Untouched by the replacement | |---|---| | Further authentication with that stolen copy | Data read or exported while the copy still worked | | The copy's worth to anyone it was passed on to | A second credential or account created with it | | The window a future unnoticed leak of this value gets | Writes and configuration changes already made | | Nothing else | What the intruder learned about the estate | The right-hand column is why "we rotated it" is never an answer to "were we harmed". If the access let someone take a copy of a dataset, the harm completed on day 1 and the 89-day ceiling bought nothing whatsoever in that incident. If the access paid off gradually — reading a queue, watching what flowed past, widening reach one step at a time — then the ceiling is real value and shortening it saves real work. ## Replacement is not withdrawal Two different actions both get called rotation, and the ceiling comes from only one of them. 1. **Replacement** — a new value is generated and put in front of the consumers that need it. 2. **Withdrawal** — the system that accepts the credential is told to stop accepting the old one. Step 1 on its own leaves the stolen copy working indefinitely; the intruder never cared which value your consumers use, only whether theirs still authenticates. Removing the old value from the store is not withdrawal either — deleting a record where the value was held does not make the system that accepts it refuse it. How two values coexist while consumers move across is its own subject; the point here is that the clock on the ceiling starts when the old value stops authenticating, and the change is not finished before then. ## When the ceiling is not a ceiling The arithmetic assumes the intruder cannot take a fresh copy. If the access that produced the first one is still open — a foothold on a host that reads the value, a place the value is written on its way to the consumer, an output where it is rendered — then day 90 hands over the replacement on a schedule, and the cadence becomes a subscription rather than a bound. Closing the escape path is a precondition of the arithmetic, not a follow-up task. The same applies in a quieter way to a copy nobody withdrew because nobody knew it existed. Every holder still presenting the old value keeps it alive if the accepting system keeps taking it. ## How to answer this in an interview A strong answer does four things in order: - names the number and how it is derived (theft to withdrawal, 89 days here); - says it is a ceiling over the interval, not a measurement of this incident; - separates it cleanly from what was already done with the access; - names the two conditions — the old value actually stopped, and the escape path closed — without which the number is fiction. A weak answer says the intruder is out because the credential was rotated. That is the belief the question exists to test, and it confuses replacing a value with revoking one, and both with containing an intrusion.