Kubernetes lacks proof of agent identity by default

The author argues that Kubernetes service accounts and user OAuth tokens fail to provide true proof of agent identity on multiplexed worker pools. To solve this, the article outlines practical plumbing layers that actually work today, including SPIFFE SVIDs, workload identity federation, and audience-bound tokens. These mechanisms separate the agent's short-lived, verifiable identity from the worker infrastructure and human user grants. Open article →