Glossary Terms: S

Service Account

Identity Types

Service accounts give workloads programmatic access to resources, but static credentials and weak lifecycle management create risk.

Single Sign-On (SSO)

IAM Concepts

SSO lets users authenticate once and access multiple applications, but its browser-based flows stop short of workload authentication.

Service-to-Service Authentication

Security Concepts

Service-to-service authentication lets one workload cryptographically prove its identity to another at runtime without human interaction.

Selector

IAM Concepts

In SPIFFE and SPIRE, a selector is an attribute used to identify and attest a workload or node, such as a Kubernetes namespace, service account name, Docker image hash, or Unix process UID. Selectors are the rules SPIRE uses to determine which SPIFFE ID a workload should receive. Getting selector definitions right is a key part of implementing least-privilege workload identity: too broad a selector grants identity to more workloads than intended, expanding the blast radius of any compromise.

SPIRE Server

IT Concepts

The SPIRE server is the central authority in a SPIRE deployment responsible for managing the trust domain, validating node attestations from SPIRE agents, and issuing signed SVIDs to attested workloads. It maintains the registry of workload selector rules that define which workloads are entitled to which identities. In production environments, the SPIRE server is a critical piece of security infrastructure and is typically deployed with high availability to avoid becoming a bottleneck for workload authentication.

SPIRE Agent

IT Concepts

A SPIRE agent is the component of the SPIRE system that runs on each node and acts as the local identity intermediary for workloads. It performs workload attestation, caches SVIDs on behalf of local workloads, and exposes the SPIFFE Workload API so workloads can retrieve their credentials without directly contacting the SPIRE server. The agent is what makes SPIFFE-based identity transparent to workloads and removes the need for application code changes.

SPIFFE Federation

IAM Concepts

SPIFFE federation is the mechanism that allows workloads in separate trust domains to authenticate each other by exchanging and trusting each other’s trust bundles. It enables secure service-to-service communication across organizational, cloud, or team boundaries without requiring shared secrets or a single centralized identity authority. Federation is how SPIFFE scales from a single cluster deployment to a multi-cloud, multi-partner workload identity architecture.

SPIFFE ID

IAM Concepts

A SPIFFE ID is a structured URI that uniquely identifies a workload within a SPIFFE-based system, following the format spiffe://trust-domain/workload-path. It serves as the stable identity anchor for a workload regardless of where it is running, what IP address it has, or what cluster it belongs to. SPIFFE IDs are embedded in SVIDs and used by relying services to make access decisions based on workload identity rather than network location.

SVID (SPIFFE Verifiable Identity Document)

IAM Concepts

An SVID is the cryptographic credential defined by the SPIFFE standard that represents a workload’s identity. It takes the form of an X.509 certificate or a JWT, both containing a SPIFFE ID that uniquely identifies the workload. SVIDs are short-lived, automatically rotated, and verifiable without shared secrets, making them the core building block of secretless authentication in SPIFFE-based workload identity systems.

Shadow Credentials

NHI Security Threats

Shadow credentials are undiscovered, unmanaged authentication secrets associated with workloads, service accounts, or applications that exist outside an organization’s official inventory and governance controls. They commonly accumulate in CI/CD pipelines, legacy scripts, and cloud environments where credentials were created ad hoc and never tracked. Shadow credentials are a significant NHI risk because they cannot be rotated, audited, or revoked, making them attractive targets for attackers looking for persistent access.