Short-lived credentials, in practice
Everyone agrees keys should expire. Then someone sets the TTL to a year so nothing breaks. Here is how we make minutes-long credentials survive contact with real workloads.
Why long TTLs win by default
Nobody argues for permanent keys. They argue for convenience, and convenience always wins the meeting. A one-hour credential means someone has to handle renewal, failure and clock skew. A one-year credential means nobody has to think until the incident.
So the default drifts long. We have seen production keys with expiries measured in years, issued by teams who would tell you, sincerely, that they believe in rotation.
Move renewal off the developer
Short-lived only works if renewal is not a human's job. In Mandavo the agent asks for a credential when it needs one, scoped to the task, and the platform hands back something that expires in minutes. There is no key to store, so there is no key to forget to rotate.
The failure modes change too. A dropped renewal is no longer a silent expiry six months from now that pages someone at 3am. It is an immediate, obvious request that either succeeds or is denied on the spot, with a reason.
What breaks, and what to do about it
Two things break when you go from a year to five minutes: batch jobs that run longer than the TTL, and code that caches a token forever. Both are worth fixing. Long jobs should re-acquire credentials at checkpoints; caches should respect expiry.
The payoff is that a leaked credential is worthless within minutes, and revocation is a first-class operation rather than a prayer. You stop asking 'is this key still valid somewhere' because the answer is always no, soon.
- #credentials
- #rotation
- #TTL
More field notes
Zero standing keys: a migration playbook
Getting to no long-lived secrets is a project, not a switch. This is the order we recommend, and the traps in each phase.
Priya Nandakumar · Head of Platform
9 min read
Writing policy at execution time, not deploy time
Access decisions baked in at deploy are stale by the time they matter. We evaluate the policy graph the moment an agent acts. Here is what that buys you.
Priya Nandakumar · Head of Platform
6 min read