<mxfile host="app.diagrams.net" agent="architecture-diagram" version="24.0.0">
  <diagram name="Identity — How a Job Gets a Credential and Loses It" id="21-identity-and-credential-flow">
    <mxGraphModel dx="1400" dy="900" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1500" pageHeight="820" math="0" shadow="0">
      <root>
        <mxCell id="0" />
        <mxCell id="1" parent="0" />
        <mxCell id="n.job" value="&lt;b&gt;microVM job&lt;/b&gt;" style="shape=umlLifeline;perimeter=lifelinePerimeter;whiteSpace=wrap;html=1;container=0;collapsible=0;recursiveResize=0;outlineConnect=0;size=58;rounded=1;arcSize=8;fillColor=#e1d5e7;strokeColor=#9673a6;fontColor=#3a2b44;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;spacingTop=9;spacingLeft=38;" vertex="1" parent="1">
          <mxGeometry x="60" y="80" width="180" height="620" as="geometry" />
        </mxCell>
        <mxCell id="_ico1" value="" style="shape=image;html=1;imageAspect=1;aspect=fixed;movable=0;resizable=0;rotatable=0;connectable=0;editable=0;deletable=0;noLabel=1;image=data:image/png,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAABmJLR0QA/wD/AP+gvaeTAAAD+UlEQVRoge3YW4iVVRQH8N+MOWpaWo0+WDgIQnYPLYosCCohLCPD7AKhREZQ0ENUJHRDEcoKqpceuj1UEBEJWWAXCoqiG5iFpZMDEV4yKjSmnLGmh/Udzuc33+0cp+nl/GG9rL3W2mvtvfbaa2866KCDDjoI9OEmTEzxTsFy9PwvHtVEN9ZiCCN4CCdjLvoT3g9YlKfc1eakk7EQszATg9iHbfixRVuL8FENua9xVou2c9GDb8TKZOkQrmrR3kR8X2AvTffkKXe37D7zcFrB2AQsbdHeHMyuIXdeHrOdACYc4XgD03EJHsG0FP8VLMFKkZINXI1VCgJpBUuVb/VmTKlh5/kc3TczMn04mCN3fpXxS0U1mJ/inYN3K5xv0F7cjaMS3R7cKvJ4asJ7L0fvthxftuTILS9z/jL8nQgO4Qms0SxzrdCnIhV2pHibROpuzJF/LOPLZPyaI3d5kfMn4ec2HG2V7sOFeAbbU/wDIv9hBl7O6G3EBiUp+s44ON8otwuSOZfkjA9iOMPrd/gtPQpXjJPzDXo/NfdXNeRXlzkPb7fhxCC+w09tBnEqzqwpm3tbp++BVtqKnVgh8nS+ODuniwPaCrqxC1tTvA9wP+7FnwlvRKR3KebgDfyjfCUGcGyBjS48V6E/InZsZUpvEu4U90Bfin8LXlXQyBVhgViVoslvrNCfit0l+usSh/9T7CyY/KB6t+yTBfojWDaWjhb1QjML+Ls087IMO0rGZtXQr42iAP4o4E+vaXdGydiBmjZqIS+ALnF95+E4NRop0WUW4bca+m1jCT5XXkE+1GzS8nCB8kp2AOvRm9GbZPTinCDKcy2srXA8Ta+J3cjiIsUFIEt7NM/aCs3KtyrhdeGThPeWKPOjkL68PsO5daMVqfC66FGm4WIt1mvR+f4udr2BYbGDww5/6HxR5d8a7bUD7dI+HI1jxG5UyWdbbRx+iJ9ODI0X1oleqke8P6pQ66m6THUrMRb0sSgEfXgqM/Yl7sKjIk0b/EMiRY+vCuLxjMHd4nHdjqNDootM8/bixJx5RsQ5TPf8Z2u+Dhs0rPhXhMTAS6IqrBc5OiVZqayxMtqmeegWi4PaL15i5D+e7sjx59scuWvKAijDPLxY4fgArlWds5tydB/IyDTa7azcle0GAGdUBPBCTTvXi11JP9r3iEUiSvzDGdvbxc9IUa82rgE0cHNGf0ichYEM/xeRzkeMXvmfTQ16sEV73eLjtupM3Z6n3O7v9GLcIFrjXvwlLqat4qtwsAVbc8XnbumPg3itjcr9sqasDJsTGivsF40b8UmwRVS86zQv2/1jON+YYzaeFW/lhSn+BnFwV2s/WzrooIMOOijGv2hVX3koN3LcAAAAAElFTkSuQmCC;" vertex="1" parent="n.job">
          <mxGeometry x="9" y="17" width="24" height="24" as="geometry" />
        </mxCell>
        <mxCell id="n.agent" value="&lt;b&gt;Job agent&lt;/b&gt;" style="shape=umlLifeline;perimeter=lifelinePerimeter;whiteSpace=wrap;html=1;container=0;collapsible=0;recursiveResize=0;outlineConnect=0;size=58;rounded=1;arcSize=8;fillColor=#dae8fc;strokeColor=#6c8ebf;fontColor=#1a2b45;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;spacingTop=9;spacingLeft=38;" vertex="1" parent="1">
          <mxGeometry x="260" y="80" width="180" height="620" as="geometry" />
        </mxCell>
        <mxCell id="_ico2" value="" style="shape=image;html=1;imageAspect=1;aspect=fixed;movable=0;resizable=0;rotatable=0;connectable=0;editable=0;deletable=0;noLabel=1;image=data:image/png,iVBORw0KGgoAAAANSUhEUgAAAIAAAACACAYAAADDPmHLAAAABmJLR0QA/wD/AP+gvaeTAAAOB0lEQVR4nO2de3RV1Z3HP79zc3MDSQgJhJsEFAV5VItPHkVJCDZr2oq6rGNaMcEKroVrtJ1ZHR/jsOqIa1521Km1zNCZji8SqMiMU9HxMUUMCT5KRa2Kgwi+gpIg4ZUH994k5zd/hCBibJJ79znnBvdnrfyX+/397t7fu19n733AYrFYLBaLxWKxWCwWi8VisVgsFovFYrFYLBbLiYYEnYBXVFbsy8vsjE/GdaY4olMVmQx6EpDd8yf5oNk9/y3toPuB9p4/aRR0u6uyDcd9JxGObF+7vuBgcN/GO04YA1SW78kZhn7DdakQoUJVzwEcgyHeA9aL6Pru7sT61ZvG7zeoHRhD2gDXlO8f2a2J76m61SDnAyGfQneDvKCitWGJrH2oLv+AT3GNM+QMsAx1dpQ2fQeRq4FLgayAU4oB6wR9eGJ90TPLEDfgfAbFkDHAMtTZObd5vqosAz036Hz6QoWtovJPu5wxq+vqpCvofAZC2hugvFwzxnU3XwPcijAx6HwGyA6BOxud6MPpboS0NsDC8k+mq+usAKYHnUtSCH9QV25Y1RB9IehUvoy0NEDl7MaCzHD4doEfYnYkHwSqqrVOt9xU82LRnqCTOZ60M0B1afNlInq/QkHQuRimxVWuXd1Q9HjQiRxL2higvFwzxrl7/g70FtIoL8Oowi8SLS03r916RiLoZCBNCnphWdOpCmuAGUHn4gcCm0OOfv+huuIP0iCXYDky0HsKKAw6Fz8R2CciF6/cGH0pyDwCHWAtLGu6UF1nA1+xygdQKHBVf1tdvufbQeYRmAEWljVfrvAUkBtUDmlANq77ePXcpgVBJRBIF1A9t2kBSi1Df4pnCleUqpqGokf8Duy7AapKm74pwv8AEb9jpzmdonJJTUP0WT+D+mqAqrm7Z4jKBiDHz7hDiA5HpMLPgaFvBjgy1dsMjPYr5hDl0wxHZ/o1RfSlD15ynoZdWIWt/IFQ2OXKo5VnbM30I5gvBujIbr5LYLYfsU4QZkQKCv7Rj0CedwFVc5ouFod1fsQ6wVBULq9tiP7GyyCeVsqi0t2FXSLbTsAHO37R0u24U39dV7LXqwCedgGdyE9t5afEqJA6nnYFnrUAVaXNF4hog5cxviK4jsgcr6aGnrQA5eWaIY7+C7byTeC4qv9WXq4Znoh7ITpWmxehnOWF9leUaWPd5qu9EDZugMpKDYlys2ndrzqiLPWiFTBugEjzniuBSaZ1v/IIE8dpc6VpWcMGUAG91aym5SjKT5ahRuvM6CCtunT3fESeNKnZS2FxiHMviFA0LsTwXIeD+1x2bO3kjc1xYh3qRch+yRounDUrwmmnhxlR4NDR6rK7sZvXXozz6e5uT2Kq6EWrNhY/bUrPbJ8izg/AbGUUFIZYcH0Os+ZlIX3YtaNNWVfbztNr2nF9OpQVCsFFV2ZzcVU2w7O/mFT1j3J5eUOMX/9rK/v3mk1KkKsBYwYw1gJUVuzLiyQSu4FhpjRPmRzmxjtHMnJU/63eG5sT/Py2AyRi3rYGkSzhL/52JNNm9v+sZv9el3tu3c+H7xo9HBTLcCLFpg6kGutPIonOKzFY+QWFIW766cAqH+DMmZksuXWEqfB9IgLXLc0bUOUD5I92uPHOfPJHG+22s7rd+J+aEjOYmVtlTgsWXJ9DXsHg0ps1L4tz53i30Wh6WYQZcwennz/a4co/M7vtUZVqU1pGDFBZsS/vyPl8IxQWh5g1L7lT35dUZZtK4wvMX5Cc9uwLsxhdZPDqAmFO1awWI82dEQNEEom5GLyc4ZzzI30O+AbCxK+FB91yDIT80Q4TpoaT+qw4Pd/JIBmSmSg1IWSkpATmmdDppWR88pMTESg+2fyyefFJGUmbEqDkZLOXl4iYKXMjBlC40IROL1nDUpucDBtu/hlUJNWcss22SqbKPOWsevp/phnI5SiHDqQ2dz64z/yCQPrlJGctvuDTlEeXKRsgHI9PwfCK4o6tnUl/Nh5TGt8zfylH484u4imsMby71fhhYCcmnZNTFklVIOQ4U1LVOJ43NsfpaEuusLc0xOlMmF8MSsSVV1+IJ/XZ9laXt35v/jS4GCj71DsmVeMGiHX0LO8Olq5O5bEH20ync5THHmyjq3Pw5lpX007ssHlTOgbKPmUDqIhxAwA8taad114c3C/u4Xtbaf7Ym4cwAE2N3TxwT+ugPvPm5gTPrO3wJiEDZZ+6AVTHpqrRp64Ly+84yO+ej/X7v12dyq/uPETdk4e9SOVzNDx9mPvvOjSgluDl52Lc+5MDnj2kUhiXqkbqE2ZhhOEHgEdJxJTlyw7y4voYl1ZlM+Fr4c/NxeMxZUtDnMcebPP0l388dU8eZtvrCb67KIfpcyJkZn2WlLqwc1sn62oG34IlQcqzgJRH79WlTR8gjE9VZyCMHOUQHRsi+8h+gMb3ukjEg9kL0EtmRDhpYgZ5+Q7trS5Nu7o9mYZ+Ce/X1hdNSEUg5RZAhFy/quBAi8uBlvS6iTURV3a+nfy0NUWCXwdQe9Q7SII3gGVok7IBBLybeFv6Y3Bz0j4wMA1MPQlL0qSBARzbAgRI8AZAOZSyhiVZgjeAiHycqoYlOQR2paqRugFU30lVw5IkBso+9S5AxBogIFwDZZ+yAbpd1xogINRA2afeBSQyt2H6PJhlILhZGt6eqkjKBlj1u1GHgDdT1bEMFv3DAy8UBj8LABDYYELHMiieMyFialv48yZ0LANHDJW5EQPEMzM3Ar7syBiWLeSMSL9nWDkjHIb1cVTcI7rceOYmE0JGSrLnzdri+bvxhmULt9ydz23L8yko9Os1wf2TV+Cw9Of5/PXP8snO9d6cAg1Hxl4pYyxbEVaZ0uqL3so/7fQwJeMzuG15PtGxwZugsDjEbcsLOGlCBqdOCfNX94z03AQu1JrSMpZpLBxeA3iyK/PYyu9ldFGI21cUcPq5vlyq3SeTp4W5fUXB54zogwliYSfymCkxY1n2dAM8YUqvl74qv5fcPIdb7s7n4qu8OxL+Zcy7ZBhL7y0gL/+LReipCYTfmHxdveEbp/Rhk3oAs7+Z1Wfl9xIKwfevy+GG2/N8GRzm5jn86I48Ft80gtAf2VF56pQws+aZv6xC0ZUm9QwPW1Wqy5rfAL5uUvWSqmy+t6T/rYf797o8eM8hz7Zjn1caYdFfjuj3/gFVePTf23hy9eBPN/XD26fVR6ctQ4ztjDU8irqDM8fffAi43KTq9jc7Objf5exZf/ziiGHDhdkVWUw5M5OPdnYZ255dMj6D65aO4LKrc/o9uq4Ktb9o5elHzZ8GEuXP7/so1+iqq/GJa2WlhiLNzf+HB7eFnvWNCNf/TV6fV7Mdj7rw9msJnv3PDl5/KY4m8bRi8rQw37piONPLsnAG0LvEOpRf/sNBtjR40gLtiEejU9euFaPrLZ6sXCwsa7pW4T+80B57agY//vuRg5oCNn/czSv1MV5/OcGH73ZyuL1vNwzLFk6ZFObs8yNML40wpmTgMZp2dfOzpQf45EPzR9MBRHVRTUPxQ8Z1TQvC0VbgFeBsL/Szcx2uvXnEoG/sgp4m+tPd3RxocWlvdY/qjRzlUFgcSuoamM11MR64u/Wonnnk1Xh0zEzTv37w8D7/q0p3z3REXsLDswczy7NYdGNuYEvDHe3KIytaef4JTw+levrCCE8XrxeWNd2vsNjLGP1dJesFqnh2FezxiPKrmoaiJZ7peyUMsKD8k9Eh19kGjPIyDsCEqWGqfpjL5GnJXeU2UN7b1smq5a1sf9OX84B7nXDX1JXPjWvxKoDnv5kjN4g/4UcsGPzIfSCYmFEkFVb57uqGose9DOJLpVTPbfpnlB/7EauX6NgQsyuyOG9OhFMmJ9cqvP9OJ1s2xXlpfYw9n/h3/0APendtfbHnb17xxQBLztNwe3bzxqDeHjo6GmLS18OMn5TByaeFGTXGYXiOw/Ccnq/f0aa0t7rs2+Py4Y5OPtrRxfa3Omlp9rvSexDYHGtpKV279QzzN0t9MZY/XFO++5QuVzYDhX7FHKLscVx3xspNJR/5Ecy3+dNDdcUfiONehIHjTCcwraj7Hb8qH3y+H6CmruQVgcsAzy/PGYIkFLmitqHkVT+D+r6CUlNftEGUa4D0uuslWFyFq1fVR//X78CBLKHVNBQ9Ikgl0P8dcCc+CVGqVtUXrQkieKCvdl1Y1nShwn8D3r7rJX1pE5UrahqizwaVQODv9r1qzifnOY7zFDAm6Fx8ptl13fmrN5VsCTKJwDfYr95UsqWL7unAi0Hn4iO/F5gddOVDGhgA4JH6sY27nOhc0Ds4sQeHqnBfvKVlTk190ftBJwNp0AUcT3VZ06XAA/jwAMln9oqwuGZjkfGd06mQFi3AsdTWF61z3fgkhfs4MVoDVdWasOrp6Vb5kIYtwLEcGSCuAGYEnUuSvA5yQ219NG3HN2nXAhzL6k0lW+LR6GyFa4F3g85n4Oh2UV0Uj0anp3PlQ5q3AMeyDHV2zm2eryrLQM8NOp8v4S2Qu3Y5Y1bX1Yk3u0MNM2QM8BkqVXObvu2o/EDhUgy+rzhJDiM8rujKVRuLngEZUtflDEEDfEZlxb68rETiClWqEeZg4gUYA6MLZZMKNYnMzP86ci5ySDKkDXAsC/+kKVsSMtt1qRChQlXPwewY5z1gvYiuD0nWb00e0AySE8YAx7P4gk9zO8OdU1zXmSyiU1GZQs87dnKAHIGRve86EGhTOEDPzedtAo0qul1VtqnrvpOl4e0mLmSyWCwWi8VisVgsFovFYrFYLBaLxWKxWCwWi8Vi8YP/B18soahnBHppAAAAAElFTkSuQmCC;" vertex="1" parent="n.agent">
          <mxGeometry x="9" y="17" width="24" height="24" as="geometry" />
        </mxCell>
        <mxCell id="n.sch" value="&lt;b&gt;Scheduler&lt;/b&gt;" style="shape=umlLifeline;perimeter=lifelinePerimeter;whiteSpace=wrap;html=1;container=0;collapsible=0;recursiveResize=0;outlineConnect=0;size=58;rounded=1;arcSize=8;fillColor=#dae8fc;strokeColor=#6c8ebf;fontColor=#1a2b45;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;spacingTop=9;spacingLeft=38;" vertex="1" parent="1">
          <mxGeometry x="460" y="80" width="180" height="620" as="geometry" />
        </mxCell>
        <mxCell id="_ico3" value="" style="shape=image;html=1;imageAspect=1;aspect=fixed;movable=0;resizable=0;rotatable=0;connectable=0;editable=0;deletable=0;noLabel=1;image=data:image/png,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAABmJLR0QA/wD/AP+gvaeTAAACzUlEQVRoge3YT4iVVRjH8c8UTZk2zriIqMmNMDYjRoITDIQhNNkupIUwROZGhEQJ0UUtIpJIGojAXctwYyiutM3YbGyRLlw6OStbREF/ZEinGrwtztx85+W9r/eee973jjBfeOCec+59nt/vfd97znkPa/SWvoryrsMQnlhu/4k/0EhdKJWBcUxiF8bwfMF37uBHXMN3uCSY6hkDOIE54cp2Gov4Bq/ULbwfH7j/SKSIWeyoQ/w4biQUno0lTAsXqBIO4++KxGfjBwynFN6Hz2oQno1bGE1l4FTN4pvxK0a6FX84svhZvIHXluMdcX/6eWE9iWJc/DP/TEG+05G5LihZrx5p0f84vhY/I9wt6PsrMteb2N9qsJWBY9gaWbAKTmGwaKDIwACOVyqnc57G0aKBIgOHtHDbY45gfb6zyMCB6rVEsQl78515A+N4oRY5cUzlO/IGJmsSEsurwgz5P3kDu+rTEsWT2JntyBvYVp+WaMayjayBdXiuXi1RrNgfZQ0Mqe4dOSWbso2sgQ0VFy7aXsTwVLaRNfBvogIU38mT+BT3usz9T7aRNbDQZeIsRW9US/gQr+PnLnKv0Jk18Ltw9JGC90rGZvASvo3M/VPZ4HXp3qg+waMltfrwRUTet8oMfJXQQAOX8WxJvR0ROTeXGZhKbKCBX7CnRb0zHeaaLxNPWAsWKzBxD19a+Yb3fkSezx9kgHDcl9pAM65gAgeFabvT37/YjoGJCg10EzPtiG8yuwoE52N3Jwa2i7vFVcW5TsQ3mV4FwhvCgVjp1NmKx/D9KjBQunA9iGHhoLVX4j/uRnyTUWHzVbf40ynEN9kirIIP1ZXPs1E4da5S+G3sq0J8kz68K+xvUos/L3K2iWEQH+G3BMIv63CRSsl6vI2LwvF5u6JvCutMW3ubMlKeQvTjZeHcZkS4SwPCir4gTMdzuLr8eY01VgP/ATwx9n2kRqjjAAAAAElFTkSuQmCC;" vertex="1" parent="n.sch">
          <mxGeometry x="9" y="17" width="24" height="24" as="geometry" />
        </mxCell>
        <mxCell id="n.idf" value="&lt;b&gt;Identity federation&lt;/b&gt;" style="shape=umlLifeline;perimeter=lifelinePerimeter;whiteSpace=wrap;html=1;container=0;collapsible=0;recursiveResize=0;outlineConnect=0;size=58;rounded=1;arcSize=8;fillColor=#e1d5e7;strokeColor=#9673a6;fontColor=#3a2b44;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;spacingTop=9;spacingLeft=38;" vertex="1" parent="1">
          <mxGeometry x="660" y="80" width="180" height="620" as="geometry" />
        </mxCell>
        <mxCell id="_ico4" value="" style="shape=image;html=1;imageAspect=1;aspect=fixed;movable=0;resizable=0;rotatable=0;connectable=0;editable=0;deletable=0;noLabel=1;image=data:image/png,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAABmJLR0QA/wD/AP+gvaeTAAADDUlEQVRoge3azatVVRjH8Y+aebMX4Q6EQKQXaiBRDkS46TCLZgbpIMgKylHQC6HYX+BMmgS90BvhoJpEgmiFoNmk0sAyiKK07GVwzTJLUe9tsN1w2j37nL32XvvcBn5hDc5z1lrP73fWWnuvtThcZm6Z11O/a/EwVuIP7MJrONlTvixMYBMOYzYoZ/EW1syVwDpuwXZMi4VH5VNsxuI50Avm4y68h5lAYNPyG57DjeMSvhRb8X0H0VG5iPexAQv6EL4GO3EuUdi04ldOafMNnsFkV9GjFmWTsn+gn0OJbVsv+iuwDac6CB80MMidePOSuJR+DigeyY14IYPwOgMlS/EsjiX09TtuGyX+dt2eKk0NlCzAeuxtmPfdUQYezyi+iYFBbsUOwxf9qWqj+ZXP1yQkzM3XeArLFC+5r4I6/9FXNXA2v65kzuAlvBh891c1UDXwdx+KWnJdEBtpYDqziC673ehFdroaqBo40SFhxGyHtsuD2PFqoGrgxw4JI7qMwE1B7IdqIBqBMx2S5mIxVgTxY9VA1cAMvsgopO0UWoWFQfxwNVA1AJ+3TBrRdgqtrokfqgYiAwdbJs3JVBD7VYNFDB9ml5PG1bg7iH8QVY4M/IQvcypK5D7xlmZPVDkyAO9kk5POg0HsghoDdayQZzd6IFH8sktiq/3sqmtQNwJH8Uli8hxsEx/qX2/T2SbjHYEbxJcGJ3BlGwMT+HmMBl6p6WNLG/ElT47JwJR47p/Eki4GrlJs8Po0cK3iLihq/3QX8SUPdDDwUYP+X61p+y0W5TAwD/t6MrC5pt0M1uUQX3Kz4jSU08AG8byfxcs5xZc8mtHAPervWY/q8Xakbr6mGHhsiPjT4oNMNhbh45YGFuL5IXXP494+xZdM4kiigSl8NqTeBTw0DvEl1yuOnqMMHFG8YYfde57D/eMUXzIpbTpF5U+ZH5epTEhf2GX5Tv3Zd+w8ori/byr+DR33OH2wHG8bLvw4Ns6VwKasxW7/Fv4LnpBpbzNIX381oNh+3KGYWgf9P67uL5OdfwCdL2jqexBRtgAAAABJRU5ErkJggg==;" vertex="1" parent="n.idf">
          <mxGeometry x="9" y="17" width="24" height="24" as="geometry" />
        </mxCell>
        <mxCell id="n.brk" value="&lt;b&gt;Secret broker&lt;/b&gt;" style="shape=umlLifeline;perimeter=lifelinePerimeter;whiteSpace=wrap;html=1;container=0;collapsible=0;recursiveResize=0;outlineConnect=0;size=58;rounded=1;arcSize=8;fillColor=#e1d5e7;strokeColor=#9673a6;fontColor=#3a2b44;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;spacingTop=9;spacingLeft=38;" vertex="1" parent="1">
          <mxGeometry x="860" y="80" width="180" height="620" as="geometry" />
        </mxCell>
        <mxCell id="_ico5" value="" style="shape=image;html=1;imageAspect=1;aspect=fixed;movable=0;resizable=0;rotatable=0;connectable=0;editable=0;deletable=0;noLabel=1;image=data:image/png,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAABmJLR0QA/wD/AP+gvaeTAAADDUlEQVRoge3azatVVRjH8Y+aebMX4Q6EQKQXaiBRDkS46TCLZgbpIMgKylHQC6HYX+BMmgS90BvhoJpEgmiFoNmk0sAyiKK07GVwzTJLUe9tsN1w2j37nL32XvvcBn5hDc5z1lrP73fWWnuvtThcZm6Z11O/a/EwVuIP7MJrONlTvixMYBMOYzYoZ/EW1syVwDpuwXZMi4VH5VNsxuI50Avm4y68h5lAYNPyG57DjeMSvhRb8X0H0VG5iPexAQv6EL4GO3EuUdi04ldOafMNnsFkV9GjFmWTsn+gn0OJbVsv+iuwDac6CB80MMidePOSuJR+DigeyY14IYPwOgMlS/EsjiX09TtuGyX+dt2eKk0NlCzAeuxtmPfdUQYezyi+iYFBbsUOwxf9qWqj+ZXP1yQkzM3XeArLFC+5r4I6/9FXNXA2v65kzuAlvBh891c1UDXwdx+KWnJdEBtpYDqziC673ehFdroaqBo40SFhxGyHtsuD2PFqoGrgxw4JI7qMwE1B7IdqIBqBMx2S5mIxVgTxY9VA1cAMvsgopO0UWoWFQfxwNVA1AJ+3TBrRdgqtrokfqgYiAwdbJs3JVBD7VYNFDB9ml5PG1bg7iH8QVY4M/IQvcypK5D7xlmZPVDkyAO9kk5POg0HsghoDdayQZzd6IFH8sktiq/3sqmtQNwJH8Uli8hxsEx/qX2/T2SbjHYEbxJcGJ3BlGwMT+HmMBl6p6WNLG/ElT47JwJR47p/Eki4GrlJs8Po0cK3iLihq/3QX8SUPdDDwUYP+X61p+y0W5TAwD/t6MrC5pt0M1uUQX3Kz4jSU08AG8byfxcs5xZc8mtHAPervWY/q8Xakbr6mGHhsiPjT4oNMNhbh45YGFuL5IXXP494+xZdM4kiigSl8NqTeBTw0DvEl1yuOnqMMHFG8YYfde57D/eMUXzIpbTpF5U+ZH5epTEhf2GX5Tv3Zd+w8ori/byr+DR33OH2wHG8bLvw4Ns6VwKasxW7/Fv4LnpBpbzNIX381oNh+3KGYWgf9P67uL5OdfwCdL2jqexBRtgAAAABJRU5ErkJggg==;" vertex="1" parent="n.brk">
          <mxGeometry x="9" y="17" width="24" height="24" as="geometry" />
        </mxCell>
        <mxCell id="n.cloud" value="&lt;b&gt;Cloud STS&lt;/b&gt;" style="shape=umlLifeline;perimeter=lifelinePerimeter;whiteSpace=wrap;html=1;container=0;collapsible=0;recursiveResize=0;outlineConnect=0;size=58;rounded=1;arcSize=8;fillColor=#f5f5f5;strokeColor=#8c8c8c;fontColor=#333333;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;spacingTop=9;spacingLeft=38;" vertex="1" parent="1">
          <mxGeometry x="1070" y="80" width="180" height="620" as="geometry" />
        </mxCell>
        <mxCell id="_ico6" value="" style="shape=image;html=1;imageAspect=1;aspect=fixed;movable=0;resizable=0;rotatable=0;connectable=0;editable=0;deletable=0;noLabel=1;image=data:image/png,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAABmJLR0QA/wD/AP+gvaeTAAAB40lEQVRoge3Yz6sOURzH8dfjXlfuQkoW6ooiIUk2imRna+kvYCMLUlIsWNhYKFtZKUp3y80/YGOHKD+6RCGJErnyazF3MsbM85z73HnmTDnv+tQ0c2bm8znnzJyZL4lEIpH4n+k1dJ21mMJKfMFjvG7o2iNjChfwFL8q9ARnsTqWwTrGcE7W01XGy/qEo5ob7UWxAjPCjJd1DRPtW/7DOG4bznyuqyKOxPkAgyE6jD24IXtOPmMWV7B9VObX4WtDAb73OfYDZ4xglC41ZD5UJ5s038PLlgPMYUOIuSUBbTbJ3vltMoFDIQ1DArRtPmdvSKOQALFW0kXfdxlO4IV253+uOyEmx2v2b8U0tgTHbZ57w564Ex/E6fWynuE4loeaX4VXHTBe1kNsCwlwuQNm6/RuUIg1+NYBo/30SGk6FV+jB7G0X8IOsBlH6g5Oi9/DIZotmi6OQKwVd6Gsl33e4O8AUf+WFsjGfKMYoPNVhAKT+UYxwIMIRoblTdXO3eI/oCGakxUX/qGHux0wOEg3q8zn7JP9l8Y2Waef2NUvAJzqgNE6XRxknmwqnZ5PG9twUdfVf/5Xsh/3O2D8I46pKbUMqr+MzQc5gB2y1Xqy7xnN8BbPcUtWknzfwj0TiUQikWif37lJeEKjXHZHAAAAAElFTkSuQmCC;" vertex="1" parent="n.cloud">
          <mxGeometry x="9" y="17" width="24" height="24" as="geometry" />
        </mxCell>
        <mxCell id="n.aud" value="&lt;b&gt;Audit trail&lt;/b&gt;" style="shape=umlLifeline;perimeter=lifelinePerimeter;whiteSpace=wrap;html=1;container=0;collapsible=0;recursiveResize=0;outlineConnect=0;size=58;rounded=1;arcSize=8;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#1e3a1e;fontSize=12;fontFamily=Segoe UI;verticalAlign=top;spacingTop=9;spacingLeft=38;" vertex="1" parent="1">
          <mxGeometry x="1270" y="80" width="180" height="620" as="geometry" />
        </mxCell>
        <mxCell id="_ico7" value="" style="shape=image;html=1;imageAspect=1;aspect=fixed;movable=0;resizable=0;rotatable=0;connectable=0;editable=0;deletable=0;noLabel=1;image=data:image/png,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAABmJLR0QA/wD/AP+gvaeTAAADIUlEQVRoge3aTWwVVRjG8V9LkW+kwYDY6kLxC5QNJEIMECEGNSa6MCaGHStXrtyqxI0xJLCCDTGBBRuCiSQuTIgxhAUsABP5SAQlCFhlYaB82AqNdfFO06E9U+5M7+29rf0nbyY9M3Pmee85M/Ocd8o0zaVtHOfOwoosuvBEFp2YjTnZMf9kx9/AAK7jGv7ErziHK1VFlEmgE5vwOtbjOXRUvfAIbuI0vscRnMK/9ei4TQg+KH7JwQmKK/hMjGxlVuCHCRSdir/xqZiKpXgFt5osPh9HxH01ihkFbSfwWNmsG8jT6MexkTvaEwcvFU+TVmN1qjGVQKqtFUjqalWxNTMlE7gt7vxWo7fMwV9p/qMzH31YWyaBDuxrAeGD+AtvlRGfZzOON0n4HezG4qri86zCTpxvsOi7+A4fYmFVsV3Yj2UF+7vxAb7At7ikmtG7IVznfnyM1xTYBbyNHakdKTvdjavixjmAPfixoOM8S8RbfEnW76Jc//1Zf/1iHfB79vdYzMF7+AhrcBjv1qBDt9G/1gV8iS1YUEsnFVmObTgkplNewzepE8YagSIGREIXcBG/ZNurYmHSl108da1FmCsWR89msTzbvihGsIjkCFRZUXUYXkqORa9IZpaYDkXze1zUa0mY4tEsGsqU9EKTilQCdakGNICkrlQC19HTWC2VOF3m4LWGbXUrROGifixewtEmC+/D9irih2jDG/ga9yZQ+DV8jieriF6A5xPti/E+9uJn8Uaul+BbYrQ/wTqjyz3tCqoSRVbikjBxu/BbQaJzxdt4ZXbO49l2vmEj1+lBI3dXPCT+EA+Ky/gp2w4mrtGON0WZsUcFMzcgTNRWE/BWzfGyKClezGlJmrmHWYkZeCeL+zgpqmMnDRu5O+MU2yXM3At4FRvwVK0nl/FCM8X8XDeivUckc1lMlV4xVfrE3J4pptVCYermibLlM8KJziuhYRT1MHNDHzY21qGv0kxJLzSpmJIJTJcWGxDTpcVmCP9/lBarfKnvFh+6VwnPMvSl/pGS/dwUpvEszogy43Fh+mpmPP9qMJJ6lxanmRT8B1M0bJ9FjBNdAAAAAElFTkSuQmCC;" vertex="1" parent="n.aud">
          <mxGeometry x="9" y="17" width="24" height="24" as="geometry" />
        </mxCell>
        <mxCell id="_m8" value="1. mint job identity" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=block;endFill=1;strokeColor=#5a6570;exitX=0.5;exitY=0.1484;exitDx=0;exitDy=0;entryX=0.5;entryY=0.1484;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.sch" target="n.idf">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_m9" value="2. bind tenant, repo, ref, class" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=block;endFill=1;strokeColor=#5a6570;exitX=0.5;exitY=0.2129;exitDx=0;exitDy=0;entryX=0.5;entryY=0.2516;entryDx=0;entryDy=0;align=left;spacingLeft=6;" edge="1" parent="1" source="n.idf" target="n.idf">
          <mxGeometry relative="1" as="geometry">
            <Array as="points">
              <mxPoint x="830" y="210" />
              <mxPoint x="830" y="240" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="_m10" value="3. OIDC token, job TTL" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=open;endFill=0;dashed=1;strokeColor=#5a6570;exitX=0.5;exitY=0.2968;exitDx=0;exitDy=0;entryX=0.5;entryY=0.2968;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.idf" target="n.agent">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_m11" value="4. needs a secret" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=block;endFill=1;strokeColor=#5a6570;exitX=0.5;exitY=0.3613;exitDx=0;exitDy=0;entryX=0.5;entryY=0.3613;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.job" target="n.agent">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_m12" value="5. present token + scope" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=block;endFill=1;strokeColor=#5a6570;exitX=0.5;exitY=0.4258;exitDx=0;exitDy=0;entryX=0.5;entryY=0.4258;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.agent" target="n.brk">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_m13" value="6. check class and policy" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=block;endFill=1;strokeColor=#5a6570;exitX=0.5;exitY=0.4903;exitDx=0;exitDy=0;entryX=0.5;entryY=0.5290;entryDx=0;entryDy=0;align=left;spacingLeft=6;" edge="1" parent="1" source="n.brk" target="n.brk">
          <mxGeometry relative="1" as="geometry">
            <Array as="points">
              <mxPoint x="1030" y="390" />
              <mxPoint x="1030" y="410" />
            </Array>
          </mxGeometry>
        </mxCell>
        <mxCell id="_m14" value="7. record the read" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=block;endFill=1;strokeColor=#5a6570;exitX=0.5;exitY=0.5742;exitDx=0;exitDy=0;entryX=0.5;entryY=0.5742;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.brk" target="n.aud">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_m15" value="8. value, redaction registered" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=open;endFill=0;dashed=1;strokeColor=#5a6570;exitX=0.5;exitY=0.6387;exitDx=0;exitDy=0;entryX=0.5;entryY=0.6387;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.brk" target="n.agent">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_m16" value="9. exchange for role" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=block;endFill=1;strokeColor=#5a6570;exitX=0.5;exitY=0.7032;exitDx=0;exitDy=0;entryX=0.5;entryY=0.7032;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.agent" target="n.cloud">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_m17" value="10. short-lived credential" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=open;endFill=0;dashed=1;strokeColor=#5a6570;exitX=0.5;exitY=0.7677;exitDx=0;exitDy=0;entryX=0.5;entryY=0.7677;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.cloud" target="n.agent">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_m18" value="11. untrusted class: refused" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=block;endFill=1;dashed=1;strokeColor=#b85450;fontColor=#b85450;exitX=0.5;exitY=0.8323;exitDx=0;exitDy=0;entryX=0.5;entryY=0.8323;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.brk" target="n.agent">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="_m19" value="12. revoke on job end" style="edgeStyle=orthogonalEdgeStyle;rounded=0;html=1;strokeWidth=1.4;fontSize=10;fontColor=#42536a;labelBackgroundColor=#ffffff;fontFamily=Segoe UI;verticalAlign=bottom;endArrow=open;endFill=0;dashed=1;strokeColor=#d79b00;exitX=0.5;exitY=0.8968;exitDx=0;exitDy=0;entryX=0.5;entryY=0.8968;entryDx=0;entryDy=0;" edge="1" parent="1" source="n.sch" target="n.idf">
          <mxGeometry relative="1" as="geometry" />
        </mxCell>
        <mxCell id="title" value="Identity — How a Job Gets a Credential and Loses It" style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;whiteSpace=wrap;fontSize=20;fontStyle=1;fontColor=#16202c;fontFamily=Segoe UI;" vertex="1" parent="1">
          <mxGeometry x="40" y="20" width="1410" height="30" as="geometry" />
        </mxCell>
        <mxCell id="rule" value="" style="line;strokeWidth=1;html=1;strokeColor=#c9d3de;" vertex="1" parent="1">
          <mxGeometry x="40" y="50" width="1410" height="10" as="geometry" />
        </mxCell>
        <mxCell id="note" value="Revocation does not wait for expiry, and the audit record is written before the value is returned, never after." style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;whiteSpace=wrap;fontSize=10;fontColor=#8a97a5;fontFamily=Segoe UI;" vertex="1" parent="1">
          <mxGeometry x="40" y="750" width="1410" height="20" as="geometry" />
        </mxCell>
        <mxCell id="foot-rule" value="" style="line;strokeWidth=1;html=1;strokeColor=#e3e9ef;" vertex="1" parent="1">
          <mxGeometry x="40" y="770" width="1410" height="10" as="geometry" />
        </mxCell>
        <mxCell id="foot" value="v 1.0   ·   owner Platform Engineering   ·   date 2026-09" style="text;html=1;strokeColor=none;fillColor=none;align=left;verticalAlign=middle;whiteSpace=wrap;fontSize=9;fontColor=#9aa7b4;fontFamily=Segoe UI;" vertex="1" parent="1">
          <mxGeometry x="40" y="780" width="1410" height="10" as="geometry" />
        </mxCell>
      </root>
    </mxGraphModel>
  </diagram>
</mxfile>
