Human Identity and Workload Identity Should Not Share an Auth Method
OIDC fits interactive operators; AppRole fits non-interactive services. Combining them weakens both lifecycle models.
identity
Device Provisioning Is an Identity Problem Disguised as Wi-Fi Setup
Getting credentials onto a device is easy; binding the right device to the right backend identity is the security boundary.
Factory Programming Should Produce Traceable Device Identity
Flashing firmware is only one step in turning a PCB into a managed product.
Device Enrollment and Heartbeat Are Different Events
Enrollment establishes trusted identity; heartbeat reports what an already known device is doing.
SIP Registration Is a Device-Identity Checkpoint
A successful REGISTER proves more than network reachability because it joins device credentials to PBX state.
Terraform for_each Keys Are Resource Identity, Not Loop Variables
The keys in for_each become part of resource addresses. Renaming a key can look like deleting one object and creating another even when the human thinks only a label changed.
QR Pairing Should Bind a Physical Device to a Backend Identity
Scanning a code is useful only if the backend can prove which unit and account the ceremony joins.
Terraform State Is Not a Cache — It Is the Binding Database
State maps resource addresses in configuration to real remote objects. Treating it as disposable cache data is how infrastructure gets orphaned or recreated.
MFA Recovery Is Not the Same Problem as Password Reset
Losing the authenticator device creates a second-factor recovery problem that should not silently collapse to the password path.
A Phone Number Is a Communication Address, Not a Complete Identity
We often treat a phone number as if it were a permanent identity. In reality, it is a communication address whose user can change, whose access can be lost, and whose presentation can be misleading.