Workload Identity

Workload Identity is the verifiable identity assigned to a software workload such as a service, job, container, agent or build process. Instead of storing long-lived API keys or static secrets inside environments, the platform gives the workload an identity at runtime. That identity can then be exchanged for short-lived tokens, mapped to roles and recorded in audit logs. The concept is especially important in AI systems because agents, pipelines and tool calls often act automatically and cannot be treated like a human user clicking a button. Without Workload Identity, a stolen CI key or service token can become a reusable skeleton key. With it, access decisions can consider which workload is calling, where it is running, what it is allowed to do and how long the permission should last. Workload Identity reduces the blast radius of leaked credentials and makes controls such as just-in-time access, rotation and incident investigation far more reliable.