Human Identity and Workload Identity Should Not Share an Auth Method
OIDC fits interactive operators; AppRole fits non-interactive services. Combining them weakens both lifecycle models.
OIDC
Why Authelia-to-OpenBao OIDC Is a Separate Phase
Human federation should be added after the secret authority is stable, not mixed into the initial bootstrap trust ceremony.