Comment by clvx

This reads like paraphrasing of SPIFFE. I’m down for it but I wonder of compromised devices that can figure it out how to keep the auth alive (or replicating user behavior). In those cases expiration still sounds like a good idea.