auditing-machine-identity-issuancelisted

# Auditing machine identity issuance: the identity is only as trustworthy as the proof that earned it Every machine identity, a service mesh certificate, a federated cloud credential, a signed workload token, is a statement the platform makes on a workload's behalf: this is who this thing is. Downstream services trust that statement and skip re-checking, which is the point of an identity system, so the entire chain of trust rests on one decision made at issuance: what proof did the platform require before it minted the identity. If that proof is weak or forgeable, the identity is legitimate and the holder is not. A certificate issued on a self-asserted name, an unvalidated label, or a reachable metadata endpoint lets an attacker who forges the proof obtain a real, trusted identity. An issuing authority whose scope is not constrained can mint identities for names it should never speak for, so a compromise of one issuer forges any workload. A workload-identity federation trust configured too broadly, a wildcard subject, an unpinned issuer, a missing audience, lets an outside principal assume a workload identity that was meant for a specific one. A certificate or token with an over-long lifetime or no revocation lets a compromised identity persist long after it should be dead. And an issuance path with no binding to a verified workload hands an identity to any caller who asks. The audit follows issuance from the proof presented to the identity granted, and checks that the proof