X

Secret rotation is cheap

Any credential can be rotated as a routine change, from what's written down.

A secret that is painful to rotate does not get rotated. Rotation stays cheap when what is written down answers four questions: how to generate the secret, everywhere it has to match, what changing it touches, and how to make the change safely. When those answers live in someone’s head, rotation waits on that person, and the credential quietly becomes permanent. A newcomer, human or agent, should be able to rotate any secret as a routine change through the one path, because the alternative is rework, and rework is the tax on knowledge no one wrote down.