Glossary
Workload Identity
A workload identity is issued dynamically to a running piece of software by the platform it's actually running on — the platform itself attests to what the workload is, based on facts it can verify directly, such as which container image is running or which deployment it belongs to — rather than the workload carrying a static, long-lived secret provisioned into its configuration ahead of time. There's no embedded credential to leak from configuration, source control, or a build artifact, because none was ever placed there.
This is a meaningful shift from the older service-account pattern, where a static credential has to be generated, distributed, stored securely, and eventually rotated by hand. A workload identity is issued fresh, typically short-lived, and tied directly to the platform's own attestation of what's currently running — removing an entire category of credential-management burden rather than just making that burden easier to manage.