Solving the Bottom Turtle

book work id

book-work-BATCH-2026-002-001

title

Solving the Bottom Turtle

subtitle

A SPIFFE Way to Establish Trust in Your Infrastructure via Universal Identity

alternate titles

Solving the Bottom Turtle — a SPIFFE Way to Establish Trust in Your Infrastructure via Universal Identity

authors

person-BATCH-2026-002-001, person-BATCH-2026-002-002, person-BATCH-2026-002-003, person-BATCH-2026-002-004, person-BATCH-2026-002-005, person-BATCH-2026-002-006, person-BATCH-2026-002-007, person-BATCH-2026-002-008, person-BATCH-2026-002-009, person-BATCH-2026-002-010, person-BATCH-2026-002-011, person-BATCH-2026-002-012

contributors

original language

lang-en

first publication date

2020-11-17

work type

collaborative_technical_book

topics

governed-agent-identities, identity-and-access-management

central subjects

SPIFFE and SPIRE, workload identity, universal service identity, infrastructure trust

inclusion rationale

Officially published, openly licensed treatment of workload identity and trust establishment that can inform—but must not be assumed identical to—AI-agent identity design.

analysis depth

deeply_analyzed

analysis basis

Complete first-edition PDF reviewed page by page from the official SPIFFE Project distribution

central thesis

Modern distributed systems require automatically issued, short-lived workload identities rooted in attestation rather than network location or manually distributed secrets; SPIFFE defines the identity documents and SPIRE supplies the attestation and issuance machinery.

principal propositions

proposition-candidate-BATCH-2026-003-001, proposition-candidate-BATCH-2026-003-002, proposition-candidate-BATCH-2026-003-003, proposition-candidate-BATCH-2026-003-004, proposition-candidate-BATCH-2026-003-005, proposition-candidate-BATCH-2026-003-006, proposition-candidate-BATCH-2026-003-007, proposition-candidate-BATCH-2026-003-008

frameworks

[object Object], [object Object], [object Object], [object Object]

evidence base

Technical architecture, threat-model reasoning, operational experience, historical examples, and five self-reported organizational case stories. It is a practitioner/project publication, not a controlled comparative study.

executive role implications

{"CISO":"Own trust-domain policy, attestation assurance, authorization separation, compromise assumptions, and auditability.","CIO":"Fund the identity control plane, migration sequencing, platform coverage, and operating model.","CTO":"Set identity semantics, integration patterns, availability boundaries, and architectural constraints.","General Counsel":"Review credential and access-log retention, privacy, evidence custody, and licensing obligations.","CEO":"Align incentives and sponsorship for cross-functional migration rather than treating identity as a security-only project.","Board Director":"Oversee concentration risk in identity infrastructure and the residual consequences of control-plane compromise."}

strongest documented arguments

Location-derived identity becomes brittle as workloads are scheduled dynamically across heterogeneous infrastructure., Short-lived credentials and automated attestation reduce dependence on manually distributed, long-lived bootstrap secrets., Authentication and authorization are distinct; a verified identity does not itself confer permission.

limitations

The case evidence is self-reported and does not isolate SPIFFE or SPIRE as the cause of the reported outcomes., The book is written by project participants and sometimes moves from design argument to ecosystem advocacy., Its workload identity model does not by itself encode an AI agent's sponsor, delegation chain, task purpose, model, session, or decision provenance., The 2020 edition predates later token formats, wider platform support, current AI-agent systems, and subsequent identity standards work.

counterpoints

NIST zero-trust guidance requires dynamic, per-request policy and contextual telemetry in addition to identity., NIST's 2026 software- and AI-agent concept work treats agent authority and authorization as distinct governance problems beyond workload authentication., A centralized signing service can become a high-impact target even when trust domains reduce blast radius.

later author interview source ids

later-author-source-BATCH-2026-003-001, later-author-source-BATCH-2026-003-002, later-author-source-BATCH-2026-003-003

related book work ids

related report ids

counter-source-BATCH-2026-003-001, counter-source-BATCH-2026-003-002, counter-source-BATCH-2026-003-003

changes in later statements

Later SPIFFE specifications add WIT token SVIDs and refine federation and workload-endpoint behavior beyond the book's 2020 scope., Later author/project material documents serverless and Windows support, narrowing two deployment constraints visible in the first edition., Later adoption claims broaden the deployment evidence but remain ecosystem-reported rather than independent comparative evaluation.

edition ids

book-edition-BATCH-2026-002-001

related source ids

source-BATCH-2026-003-001

related statement ids

statement-BATCH-2026-003-001, statement-BATCH-2026-003-002, statement-BATCH-2026-003-003, statement-BATCH-2026-003-004, statement-BATCH-2026-003-005, statement-BATCH-2026-003-006, statement-BATCH-2026-003-007, statement-BATCH-2026-003-008, statement-BATCH-2026-003-009, statement-BATCH-2026-003-010, statement-BATCH-2026-003-011, statement-BATCH-2026-003-012, statement-BATCH-2026-003-013, statement-BATCH-2026-003-014, statement-BATCH-2026-003-015, statement-BATCH-2026-003-016, statement-BATCH-2026-003-017, statement-BATCH-2026-003-018

related proposition ids

proposition-candidate-BATCH-2026-003-001, proposition-candidate-BATCH-2026-003-002, proposition-candidate-BATCH-2026-003-003, proposition-candidate-BATCH-2026-003-004, proposition-candidate-BATCH-2026-003-005, proposition-candidate-BATCH-2026-003-006, proposition-candidate-BATCH-2026-003-007, proposition-candidate-BATCH-2026-003-008

related dossier ids

rights notes

Official PDF is licensed CC BY 4.0. This batch uses original paraphrases and no direct quotations; attribution and canonical link are retained.

review status

deep_analysis_complete_machine_reviewed

publication status

published

workflow status

published

machine review status

ready_for_human_review

human review status

approved

reviewed by

Murray Newlands

reviewed at

2026-08-16T23:17:22Z

{
  "provenance": [
    {
      "source_url": "https://spiffe.io/book/",
      "accessed_at": "2026-08-15",
      "retrieval_method": "Official publisher, project, or author-hosted bibliographic page inspected through public web access",
      "exact_locator": "Official work page and bibliographic metadata",
      "content_hash": null,
      "batch_id": "BATCH-2026-002",
      "prompt_id": "OEII-BOOK-METADATA",
      "prompt_version": "2.0",
      "notes": "Accepted discovery candidate candidate-BATCH-2026-001-095."
    },
    {
      "source_url": "https://spiffe.io/pdf/Solving-the-bottom-turtle-SPIFFE-SPIRE-Book.pdf",
      "accessed_at": "2026-08-15",
      "retrieval_method": "Complete exact edition retrieved from an official public source and reviewed in full",
      "exact_locator": "Complete 194-page PDF; printed and PDF page numbers align",
      "content_hash": "8353e3cf6fb8859ff34b0a43fe8146d7580dd32c9ace863c1a4758440f898fcb",
      "batch_id": "BATCH-2026-003",
      "prompt_id": "OEII-BOOK-DEEP-ANALYSIS",
      "prompt_version": "2.0",
      "notes": "Whole-edition analysis; no human approval granted"
    }
  ],
  "revision_history": [
    {
      "changed_at": "2026-08-15T00:00:00Z",
      "changed_by": "OEII analysis agent",
      "summary": "Advanced from catalogued metadata to complete-edition deep analysis.",
      "batch_id": "BATCH-2026-003"
    },
    {
      "changed_at": "2026-08-16T23:17:22Z",
      "changed_by": "Murray Newlands",
      "summary": "Approved for the governed-identities pilot release under the exact scope, exclusions, rights treatment, and limitations recorded in issue #18.",
      "batch_id": "BATCH-2026-003"
    }
  ]
}