#workload-identity
Tagged “workload-identity”
4 articlesAzure DevOps opens a Service Connection off-ramp from PATs and build session tokens
A preview from Microsoft DevOps lets Azure Pipelines authenticate against Azure DevOps with an Entra-backed Service Connection instead of a Personal Access Token or Build Session token. The coverage is scoped: repo resources, YAML template checkouts, NuGetAuthenticate, InvokeRESTAPI and the AzureCLI task.
Aug 15, 2026 · Maya OkonkwoIdentity and accessVercel buys Better Auth on the pitch that agents need their own login
Vercel has acquired Better Auth, framed as a bet that AI agents opening PRs, reviewing code and creating deployments should hold first-class identity of their own. For CI/CD platforms, that reopens the question of what the merge and deploy gates are actually verifying.
Jul 8, 2026 · Maya OkonkwoSecurity & supply chainAgent identity is the new wall between functional dev and security review
A New Stack analysis argues agentic systems pass functional review and then stall at the security gate because no one scoped identity, permissions or audit at the platform layer first. For CI/CD owners, it pushes a familiar workload-identity problem onto a much larger fleet of callers.
Jun 28, 2026 · Maya OkonkwoSecurity & supply chainVault learns to speak SPIFFE, and your pipeline's static token is on notice
HashiCorp wired SPIFFE into Vault as both an auth method and a secrets engine, positioning Vault as a workload-identity broker that sits next to SPIRE rather than replacing it. For CI/CD that means one more reason the long-lived bearer token in your job secrets is harder to defend by the day.
Jun 17, 2026 · Tomás Vega