Mutable reference

Expanded Definition

A mutable reference is a pointer-like name, alias, or branch that can move to a different commit or code object over time. In software delivery, that flexibility is useful for fast-moving development, but in identity-driven pipelines it creates a trust problem because the reference no longer guarantees the same underlying content.

For NHI and CI/CD governance, the security issue is not the reference itself but the instability of what it resolves to. A workflow that targets a branch, tag, or label may execute different code tomorrow than it did during review today. That is why this term matters alongside supply chain controls, repository protections, and release integrity checks in the NIST Cybersecurity Framework 2.0. Definitions vary across vendors when they describe pinning, immutability, or version locking, but the operational principle is consistent: the more mutable the reference, the weaker the assurance boundary.

In practice, teams often confuse a mutable reference with a stable identifier because the name looks authoritative even when the target changes. The most common misapplication is treating a branch or floating tag as if it were a fixed release, which occurs when build and review processes do not verify the resolved commit at execution time.

Examples and Use Cases

Implementing mutable reference controls rigorously often introduces delivery friction, requiring organisations to weigh developer convenience against provenance assurance and repeatable builds.

• Using a floating branch in GitHub Actions to pull workflow logic from the latest commit on that branch, which can silently alter runtime behaviour after code review.
• Relying on a moving tag such as

  latest

  in a pipeline, where the tag name stays the same but the image or artifact behind it changes.
• Allowing deployment scripts to reference aliases for secrets, tokens, or artifacts without recording the resolved version, weakening auditability and rollback confidence.
• Comparing the checked-in workflow definition against the executed content and rejecting runs when the resolved reference differs from the reviewed source, a pattern consistent with guidance in the Ultimate Guide to NHIs.
• Freezing build inputs to immutable commit SHAs or digests while reserving mutable aliases only for human convenience layers, not for trusted execution paths, a practice aligned with secure supply chain expectations in the NIST Cybersecurity Framework 2.0.

Teams also use mutable references in release channels, canary promotion, and emergency hotfix routing, but each of those use cases needs verification so that a label cannot be repointed without approval.

Why It Matters in NHI Security

Mutable references matter because NHI attacks rarely start with the credential alone. They often begin with a trusted path that silently changes underneath automation. When a workflow, token, or service account is allowed to act on a reference that can drift, the attacker only needs to alter the target once to influence many downstream runs.

This risk is especially serious in CI/CD and agentic automation, where the executor is non-human and therefore does not question whether the target changed after approval. NHIMG research shows that 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, which makes mutable references even more dangerous because they expand the attack surface around already exposed assets. The Ultimate Guide to NHIs also shows that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, reinforcing that reference integrity is part of identity security, not just software hygiene.

Practitioners should treat mutable references as a governance decision, not a convenience default, and require explicit review, pinning, or verification wherever the reference can drive execution or access. Organisations typically encounter the consequence only after an unexpected build, poisoned deployment, or unauthorized workflow run, at which point mutable reference control becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Why do reference architectures matter in identity and access management?
• How should healthcare teams use reference architecture to improve access security?
• What should IAM teams review when building a healthcare reference architecture?
• Reference Architecture