H.9.3 Credentials

A credential is authority delegated to a named workload or person for a bounded operation.

• Assign separate owners and authorities for dependency intake, execution, cache writes, CI, signing, publication, and deployment.
• Define which repositories, teams, lanes, and protected scopes may request each credential and who approves exceptions.
• Prefer scoped and short-lived issuance where the system supports it; define rotation, revocation, offboarding, and audit in all cases.
• Keep builder, signer, publisher, and deployer identities non-interchangeable.
• Exercise compromise and breakglass paths and identify which results or artifacts require invalidation afterward.