Workload Identity
Why Service Accounts Are the New Attack Surface
The average microservice deployment carries 40+ service accounts, most created by engineers who have since left the company.
Blog
The Aembit Blog
Non-human identity, zero trust for workloads, and the security engineering behind modern service architectures.
SPIFFE
SPIFFE/SPIRE for Application Developers: What You Actually Need to Know
SPIFFE is a standard, SPIRE is an implementation. Here is what the difference means when you are trying to authenticate your Kubernetes services without stored credentials.
Zero Trust
mTLS Is Not Enough: What You Still Need for Workload Identity
Mutual TLS proves both ends of a connection have valid certificates. It does not tell you which workload made the call, under which policy.
CI/CD
GitHub Actions OIDC: Finally Stop Storing AWS Access Keys
A step-by-step guide to removing every long-lived AWS access key from your CI pipelines and replacing them with scoped, per-run tokens.
Workload Identity
The Credential Rotation Trap: Why Manual Rotation Defeats Its Own Purpose
Every team knows they should rotate service credentials every 90 days. Almost no team actually does it on schedule. This is a system design failure.
Kubernetes
Kubernetes Workload Identity: A Field Guide for Platform Teams
Service accounts in Kubernetes are workload identities, but they are also a common source of over-provisioned RBAC and stale permissions.
AI Security
Your LLM Agent Is Making API Calls. Do You Know What Identity It Is Using?
When a LangChain agent calls your internal data API, it is authenticating with something. In most deployments today, that something is a shared API key.
Serverless
Lambda Identity Beyond Execution Roles: What AWS Does Not Solve for You
AWS Lambda execution roles handle Lambda-to-AWS-service authentication. They do not handle Lambda calling your own APIs cleanly.
Zero Trust
Zero Trust Was Always About Workloads, Not Just Humans
The BeyondCorp model that inspired zero trust architectures was built around eliminating implicit network trust for machine traffic.
Engineering
How to Inject Workload Identity Into Envoy Proxy Without Modifying Application Code
Envoy proxy intercepts all outbound traffic from your service. That interception point is exactly where workload identity should be attached.
Security
Non-Human Identity Audit Checklist for Platform Teams
Before your next SOC 2 audit, you should be able to answer: what service credentials exist, who created them, when they expire, and what they access.
Tutorials
Workload Identity for Snowflake Connections: No More Password Rotation
Data pipelines authenticating to Snowflake with stored passwords are a common weak point in analytics infrastructure.
Engineering
OIDC Token Lifecycle: From Issuance to Expiry in Workload Authentication
What actually happens inside a 15-minute OIDC token: claims, scoping, validation, and what to log.
AI Security
Securing Autonomous AI Pipelines: Identity at the Agent Layer
AI pipelines that spawn sub-agents, call external APIs, and retrieve documents need a coherent identity model.
Tutorials
Identity Operations for Platform Teams: The Runbook
A practical runbook for platform teams managing workload identity at scale: inventory, migration priority, legacy services, and measuring progress.
Tutorials
A Field Guide to Writing Aembit Access Policies
Aembit's policy language gives you fine-grained control over which workloads can call which services under which conditions.
AI Security
Why AI Agents Fail Security Audits and What to Do About It
Security auditors are starting to ask about AI agent authentication. Most teams fail. The issues are predictable: shared keys, no audit trail, no scoping.
Engineering
Service Mesh and Workload Identity: Patterns That Actually Work Together
Istio and Linkerd both provide mTLS between services. But they do not provide the policy layer, the audit trail, or the non-Kubernetes workload support.
Zero Trust
Workload Identity in Multi-Cloud Environments: One Policy Layer for AWS, GCP, and Azure
Each cloud provider has its own workload identity primitive. Managing them separately means three audit trails and three places for misconfiguration.
AI Agents
Agentic AI and the Identity Gap: What the Next 12 Months Require
Agentic AI deployments are outpacing the security infrastructure around them. Non-human identity management is the missing layer.