Explore Non-Human Identity & Secrets Management

Somewhere in your org, machine identities outnumber humans ten to one — service accounts, CI tokens, OAuth grants, workload roles — and almost none of them can be asked for a second factor. A leaked human password at least meets an MFA prompt. A leaked service token just works, at 3am, for whoever holds it. This topic is about what actually stands between that token and damage: not the network edge, but scope and lifetime.

your tutor starts where the incidents start: a real leaked key, and the question 'what can someone do with this right now?' From there you work through the lifecycle — how a credential gets issued, how broad its permissions are, where it's stored, whether it rotates on paper or in practice, and what revoking it actually costs you mid-incident. You'll hit the traps everyone hits: assuming a private repo is a safe repo, assuming an env var is invisible, treating 'we put it in Vault' as the finish line instead of the opening question.

This is a companion to your coursework, not a replacement for it — your tutor won't hand you a rotation policy to copy into an assignment. It'll sketch the credential's blast radius on the whiteboard and make you argue for the smaller one.