Estate security · workload identity

One name every workload proves: unsigned.gg

Agents, services, and pipelines on the estate don't authenticate with shared secrets. Each workload holds a cryptographic identity issued at runtime, and every one of those identities is rooted in a single name — the trust domain.

standard · SPIFFE / SPIRE trust domain · unsigned.gg status · ratified 2026-07-19 credential life · minutes-to-an-hour

The concept

The trust domain is the root of identity — the name a verifier trusts.

In SPIFFE — the open workload-identity standard the estate runs on — every workload is named by a URI: the trust domain, then a path describing what the workload is. The trust domain is the half a verifier anchors to: one certificate-authority bundle per domain, and every identity under it chains to that bundle.

spiffe://unsigned.gg/cluster/cygnus/ns/spire/sa/spire-agent

Instead of asking "does this caller hold the right password?", a service asks "can this caller prove, cryptographically, that it is who the trust domain says it is?" There is no API key to leak and no password to rotate — identity documents are minted fresh, expire in minutes to an hour, and are verified against the domain's bundle on every use.

The trust domain is also the estate's most immutable name. Every issued identity and every verifier embeds it; renaming it later means re-minting every identity and re-anchoring every service that checks one. It's chosen once, deliberately — which is why it was ratified by the operator before the first identity was ever issued.

The decision · ratified 2026-07-19

Estate-wide unsigned.gg — clusters live in the path, not the root.

Option A — chosen

unsigned.gg

One trust domain for the whole estate. Clusters come and go — the identity root doesn't. Off-cluster callers (workstations, terminals) are just more workloads under the same name, no federation machinery required. Aligns with the long-run plan: the estate as its own certificate authority.

ratified

Option B

tailnet name

Rooting identity in the VPN vendor's generated tailnet name couples the estate's most immutable name to a renameable artifact. The tailnet moves packets; it doesn't get to name who we are.

rejected

Option C

per-cluster domains

Clean isolation, but the moment a second cluster or any workstation caller appears, every cross-boundary call needs federation. Isolation stays available later as a choice — it shouldn't be the default tax.

rejected

How it works in practice

Identity is attested, issued, and expired — never configured.

Attestation

A workload never asserts its own name. The platform proves what it is — which node, which service account, which process — and the identity server issues accordingly.

Short-lived credentials

X.509 identities live about an hour; token identities about five minutes. Rotation is automatic. A stolen credential is a closing window, not a standing key.

No static secrets

Service-to-service trust needs no shared passwords or long-lived API keys — the class of credential that leaks in logs and repos simply isn't there.

Authority is scoped

Identity says who; policy says what. Agents can dispatch work and inspect results; the irreversible action — settling an agent's output into the world — is reserved to operator-held identities.

This is the identity layer under the estate's governed-autonomy stack: every autonomous agent run executes inside it, so the audit trail can say — cryptographically, not by convention — which workload did what, on whose behalf, and who signed off.