Topic starter
12/06/2026 12:29 am
TL;DR: Kernel tracepoints can be carried through eBPF, OpenTelemetry, and Prometheus to turn raw file-creation events into labeled metrics, according to Riptides. But the deeper lesson is that kernel-level telemetry only helps if identity and workload posture are already governed, and the real gap is not visibility alone, but whether workloads have disciplined, reviewable identity boundaries.
Editorial analysis by NHI Mgmt Group, based on content published by Riptides: “From Tracepoints to Prometheus: The journey of a kernel event to observability.”.
Key questions
Q: How should teams use telemetry to govern workload identity?
A: Teams should use telemetry to verify whether workload behaviour matches declared identity and access intent.
Q: Why does eBPF visibility not solve NHI risk by itself?
A: Because visibility does not reduce privilege or assign accountability.
Q: What are the signs that workload telemetry is masking identity gaps?
A: The main signs are rich runtime data with weak ownership, unclear entitlement scope, or stale workload credentials.
Practitioner guidance
- Define workload identity boundaries first Assign each workload an accountable owner, explicit entitlement scope, and lifecycle state before relying on runtime telemetry to explain its actions.
- Separate observability from authorisation Use kernel telemetry to capture behavior, but keep access decisions, privilege scope, and revocation in the identity control plane.
- Inventory service posture alongside traces Correlate runtime events with workload posture records so you can tell which identities are active, stale, or unowned.
Bottom line: Kernel telemetry can expose workload activity with precision, but it does not replace identity governance for the workload behind the signal.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 9:45 am
Telemetry without workload identity governance creates a visibility surplus and a control deficit. Riptides' pattern shows that kernel events can be enriched, labeled, and exported with precision, but that only improves what operators can see. It does not answer whether the workload was entitled to act, who owns that entitlement, or how it is revoked when the workload changes. The practitioner conclusion is that observability must sit downstream of governed identity boundaries, not in place of them.
A question worth separating out:
Q: What is the difference between telemetry and workload authorisation?
A: Telemetry records and exports what happened. Authorisation decides whether the workload should have been able to do it in the first place. In NHI programmes, that distinction matters because a highly instrumented workload can still be overprivileged, unowned, or left active after the business need has changed.
👉 Read our full editorial: Kernel telemetry and eBPF tracing still expose workload identity gaps
This post was modified 1 day ago by NHI Mgmt Group