Observability Platform · View 24 of 25 · Assurance
The rule
- Step 5: resource identity comes from the credential the workload proved, never from a service name the payload asserts. Everything downstream — budgets, cost attribution, ownership, authorisation — is only as trustworthy as that step.
- Step 6: a credential that identifies a team rather than a workload is rejected. Shared ingest keys are how attribution quietly becomes fiction.
The read path
- Human access is SSO with MFA, authority from group membership rather than per-person grants, and authorisation evaluated by team and data class.
- Step 10 writes the read to the audit before executing it, so an interrupted or failed query is still recorded as an attempt.
Risks
- Credentials are short-lived, which means the platform depends on STS being available for every workload that starts during an incident. A regional STS problem becomes an ingest problem for new pods.
- Group-derived authority is only as good as the groups. A broad "engineering" group with access to the compliance class would defeat view 23 entirely.
