Notifications
Clear all
Topic starter
06/09/2026 6:20 pm
TL;DR: SPIFFE’s 12-month roadmap responds to workloads that no longer run only on owned hosts, including serverless, managed Kubernetes, CI systems, and AI agents, according to Riptides. The shift matters because workload identity standards now have to handle non-deterministic execution and trust-domain discovery, not just static service-to-service identity.
NHIMG editorial — based on content published by Riptides: SPIFFE’s roadmap for agents and modern workload identity
By the numbers:
- 69% of organisations now have more machine identities than human ones.
- 57% of organisations lack a complete inventory of their machine identities.
- Only 38% have automated certificate lifecycle management in place.
Questions worth separating out
Q: How should security teams govern workload identity across mixed cloud environments?
A: Security teams should use a workload identity control plane that can issue short-lived credentials, enforce policy at access time, and preserve audit context across Kubernetes, VMs, CI/CD, and SaaS.
Q: Why do AI agents change workload identity assumptions?
A: AI agents introduce runtime variability, which means the same identity can take different paths through infrastructure from one execution to the next.
Q: What is the biggest federation problem for workload identities across organisations?
A: Manual trust exchange does not scale.
Practitioner guidance
- Inventory managed-runtime workloads separately Map every workload that runs in serverless, managed Kubernetes, CI, or partner-operated environments where a node agent cannot be installed.
- Test federation without manual trust exchange Validate whether trust domain onboarding still requires manual bundle discovery, profile setup, or one-off configuration.
What's in the full article
Riptides' full article covers the operational detail this post intentionally leaves for the source:
- The roadmap items in more depth, including remote Workload API support and filesystem-based delivery for workloads that cannot host local agents.
- The specific environments SPIFFE names as outside the original model, including managed Kubernetes, serverless platforms, CI systems, and managed AI-agent platforms.
- The standards and discovery direction behind the .well-known approach for trust-domain discovery across organisations.
- The article's own interpretation of how post-quantum readiness fits into the longer-term workload identity roadmap.
👉 Read Riptides' analysis of SPIFFE's roadmap for modern workload identity →
SPIFFE for agents and serverless workloads: what changes now?
Explore further
06/09/2026 6:21 pm
Workload identity is no longer a host-local problem: The old assumption was that teams could place an identity agent next to the workload and control the node. That assumption fails when workloads run in managed Kubernetes, serverless platforms, or CI systems that operators cannot instrument directly. The implication is that workload identity strategy now has to account for identity delivery outside the host boundary.
A few things that frame the scale:
- 69% of organisations now have more machine identities than human ones, according to The Critical Gaps in Machine Identity Management report.
- 57% of organisations lack a complete inventory of their machine identities, which makes runtime identity coverage difficult to prove at scale.
A question worth separating out:
Q: Should organisations redesign workload identity now or wait for broader standard maturity?
A: They should redesign now for the environments already in production. Managed Kubernetes, serverless, CI, and agentic workloads are already outside the original host-centric model, so waiting only widens the gap between policy and runtime. The practical goal is to make identity portable before the old assumptions become unfixable.
👉 Read our full editorial: SPIFFE’s roadmap shows workload identity catching up with agents
