# Identity as Configuration, Not Evidence

- **Artifact ID:** CHQ-EX-2026-001
- **Public record:** https://record.cybersecurityhq.com/exhibits/chq-ex-2026-001
- **Machine-record SHA-256:** `b853e4aad4f41cf22e0776c7e1cefa221cb055d4477f391b285d7be1a54f34b9`

## Complete structured record

```json
{
  "id": "CHQ-EX-2026-001",
  "title": "Identity as Configuration, Not Evidence",
  "subtitle": "Observed practices in directory services, authentication protocols, and machine credentials",
  "classification_notice": [
    "This document is published as a CHQ Exhibit. It records historical conditions, design decisions, and industry practices as they existed during the periods described. This Exhibit records observed configurations, defaults, and operational practices as documented in specifications, vendor documentation, and enterprise operating norms during the stated period.",
    "This document does not address present conditions and carries no current applicability.",
    "CHQ Exhibits are not superseded by later artifacts unless explicitly invalidated for factual error."
  ],
  "metadata": {
    "artifact_class": "EXHIBIT",
    "temporal_scope": "HISTORICAL (1995-2022)",
    "authority_level": "NON-JUDGMENTAL",
    "reliance_status": "CONTEXT_ONLY",
    "update_policy": "ERRATA_ONLY",
    "temporal_start": "1995-01-01",
    "temporal_end": "2022-12-31"
  },
  "sections": [
    {
      "heading": "I. Identity as Access Plumbing (1995-2003)",
      "content": [
        "The Lightweight Directory Access Protocol version 3 was specified in RFC 2251 in 1997. The protocol defined operations for searching, reading, and modifying directory entries. Directory entries stored attributes: name, organizational unit, group membership, password hash. The data model was optimized for lookup and retrieval. No fields existed for issuance context, credential provenance, or authentication event retention.",
        "Microsoft released Active Directory with Windows 2000. The directory structure organized entries by organizational unit, mirroring departmental hierarchies. Trust relationships between domains were configured separately from the directory structure itself. Group Policy Objects controlled machine and user configuration. Identity and access configuration existed in the same administrative surface.",
        "Kerberos was the default authentication protocol in Active Directory environments. Ticket-granting tickets were configured with default lifetimes of 10 hours. Renewable ticket lifetimes were measured in days. Ticket issuance was logged on domain controllers. Retention of these logs varied by organization. No centralized log aggregation standard existed for authentication events during this period.",
        "Directory entries were created by IT administrators through manual processes or batch scripts. One entry corresponded to one employee. Entries were provisioned at hire and deprovisioned at termination. The interval between employee departure and account deprovisioning was not systematically measured during this period.",
        "IT departments tracked provisioning speed and helpdesk ticket volume. Directory accuracy, credential hygiene, and identity lifecycle completeness were not standard operational metrics in ITIL v2 (published 2000-2002) or in contemporaneous IT management frameworks."
      ]
    },
    {
      "heading": "II. Configuration Wins by Necessity (2003-2008)",
      "content": [
        "Internal application counts at mid-size enterprises grew from tens to hundreds during this period. Each application maintained its own user store or connected to a central directory. Manual account creation per application required separate administrative action per user per system.",
        "SAML 1.0 was published in 2002. SAML 2.0 was ratified in 2005. Both specifications addressed federated authentication: allowing a user authenticated in one domain to access resources in another without re-authenticating. The specifications defined assertion formats and protocol bindings. Assertion content described authentication events. Assertions were not designed for long-term retention or post-hoc forensic reconstruction.",
        "Service accounts were created to allow applications and automated processes to authenticate to other systems. These accounts were configured with static passwords. Passwords were stored in configuration files, deployment scripts, application property files, and in some cases source code repositories. Service account credentials were managed by application teams. Security teams did not have provisioning or rotation authority over these credentials at most organizations during this period.",
        "Shared credentials for non-human access were observed across development, staging, and production environments. A single set of credentials was reused across environment boundaries. Environment-specific credential issuance was not a standard practice.",
        "No widely adopted enterprise standard existed during this period for machine-to-machine authentication distinct from human authentication. SAML, Kerberos, and LDAP bind operations were designed for interactive or delegated human authentication flows. Machine-initiated authentication reused these protocols without modification.",
        "Early Privileged Access Management products, including CyberArk (founded 1999, enterprise PAM product launched mid-2000s), focused on session recording and credential vaulting for human privileged users. Non-human credentials, service accounts, and application-to-application authentication were outside the primary scope of these products during this period."
      ]
    },
    {
      "heading": "III. The Normalization of Long-Lived Trust (2008-2014)",
      "content": [
        "API keys issued by major platforms during this period were configured without expiration dates by default. Amazon Web Services, Google Cloud Platform, and Stripe issued API keys that remained valid until explicitly revoked. Rotation mechanisms were available. Rotation was not enforced by the issuing platform.",
        "Credential rotation was not performed in many environments during this period. Rotation required coordination across the team that owned the credential, the team that operated the consuming service, and a change management process. Service disruption was observed during some rotation events.",
        "Uptime SLAs specified penalties for service interruption. No equivalent contractual penalty existed for credential age, credential reuse, or absence of credential rotation.",
        "OAuth 2.0 was specified in RFC 6749 in 2012. Bearer tokens were defined with a recommended but optional expiration parameter. Refresh tokens were commonly configured with indefinite lifetimes. The specification did not mandate maximum token lifetimes.",
        "SSH keys were generated during employee onboarding and deployed to servers. Keys persisted on servers after employee role changes, team transfers, and departures. Comprehensive SSH key inventories were not maintained at most organizations. The OpenSSH authorized_keys file format did not include fields for issuance date, issuer, or expiration.",
        "AWS Identity and Access Management was launched in 2010. Access keys were issued per IAM user. No enforced rotation policy existed at the platform level. Console warnings for aged access keys were introduced in 2022. Between 2010 and 2022, access key age was visible in the IAM credential report but did not trigger automated action.",
        "Credential rotation tooling during this period required custom scripting. No commercial product addressed automated rotation at scale across heterogeneous environments combining cloud services, on-premise systems, and SaaS platforms."
      ]
    },
    {
      "heading": "IV. Tooling Reinforces the Model (2014-2019)",
      "content": [
        "HashiCorp Vault was released in 2015. The product was designed for secrets storage, access control, and dynamic secret generation. Dynamic secrets (short-lived, automatically revoked) were a documented capability. Commonly documented use cases in vendor case studies and conference presentations during this period included centralized secrets retrieval: applications queried Vault for credentials at runtime. Credentials retrieved from Vault were not universally configured with short lifetimes.",
        "Secrets management products were deployed across enterprises during this period. Credentials were migrated from plaintext configuration files to encrypted storage. The credentials themselves retained long lifetimes. Storage location changed. Credential lifecycle did not.",
        "Vendor pricing models for secrets management were based on secrets stored, nodes connected, or users provisioned. Rotation frequency, credential lifetime, and issuance velocity were not standard pricing dimensions.",
        "Kubernetes introduced the Secrets resource type in 2015. Kubernetes Secrets were base64-encoded and stored in etcd. By default, any pod within a namespace could access Secrets available to that namespace. Encryption at rest for etcd was available but not enabled by default. The Secrets resource type did not include fields for expiration, rotation status, or issuance provenance.",
        "IAM dashboards displayed user counts, role counts, and policy attachment summaries. Credential age distribution, credential usage frequency, and per-credential attribution capability were not standard dashboard metrics in AWS, Azure, or GCP console interfaces during this period.",
        "Compliance frameworks, including SOC 2 Type II and ISO 27001 (2013 revision), required access reviews. These frameworks did not specify credential lifetime maximums or rotation frequencies for non-human identities. Compliance was achievable with long-lived credentials provided that access reviews were documented.",
        "The term \"credential sprawl\" entered industry vocabulary during this period. It appeared in vendor marketing materials, analyst reports, and conference presentations. The term was framed as a visibility and inventory management problem: organizations did not know how many credentials existed or where they were stored."
      ]
    },
    {
      "heading": "V. Cloud and API Acceleration (2019-2022)",
      "content": [
        "Machine identities outnumbered human identities in enterprise environments during this period. CyberArk's 2021 Identity Security Threat Landscape report cited a 45:1 ratio. The 2022 Machine Identity Management report by the Ponemon Institute cited figures exceeding 80:1 in surveyed organizations. Ratios varied by industry, cloud maturity, and measurement methodology.",
        "Ephemeral compute, including containers and serverless functions, was widely deployed during this period. Compute instances were created, executed, and destroyed within minutes or seconds. Credentials consumed by these workloads were managed by separate systems. Compute lifecycle was measured in seconds to hours. Credential lifecycle was measured in months to years. These lifecycles were managed independently.",
        "Cloud providers issued temporary credentials for some workload types. AWS Security Token Service issued session tokens with configurable lifetimes. GCP Workload Identity Federation allowed Kubernetes service accounts to impersonate IAM service accounts with short-lived tokens. Permanent access keys remained simultaneously available and in use. Adoption of temporary credentials varied by organization and workload type.",
        "CI/CD pipelines stored long-lived secrets for deployment operations. Jenkins, GitLab CI, GitHub Actions, and CircleCI provided encrypted secret storage within pipeline configurations. Pipeline credentials were configured with broad permissions. Pipeline failures were documented in CI/CD troubleshooting guides when credentials were narrowly scoped.",
        "No unified standard existed for machine identity lifecycle management across cloud providers, on-premise systems, and SaaS platforms during this period. SPIFFE (Secure Production Identity Framework for Everyone) was published in 2017 and adopted incrementally. It did not achieve ubiquitous enterprise adoption during this period.",
        "Engineering teams were measured on deployment frequency, lead time for changes, and mean time to recovery. These metrics were codified in the DORA (DevOps Research and Assessment) framework. Credential hygiene, credential age, and identity lifecycle completeness were not included in DORA metrics or in contemporaneous DevOps maturity models.",
        "Identity-related findings appeared in penetration test reports during this period. Commonly referenced findings included static credentials in code repositories, excessive permissions on service accounts, and absence of credential rotation. These findings recurred across consecutive assessment cycles at the same organizations during this period."
      ]
    }
  ],
  "closing_statement": "This Exhibit does not assess effectiveness, risk, or sufficiency of the practices described.",
  "hash_scope": "Full exhibit content body",
  "hash_generated": "2026-02-07"
}
```