# Machine identity and credential register

Record identifiers and approved references. Do not record secret values.

| Workload | Business owner | Operator | Environment | Target audience | Allowed actions |
| --- | --- | --- | --- | --- | --- |
| | | | | | |

| Credential reference | Authentication method | Expiry | Rotation route | Revocation owner |
| --- | --- | --- | --- | --- |
| | | | | |

| Test | Expected result | Observed result | Date |
| --- | --- | --- | --- |
| Intended operation | Allowed | | |
| Wrong audience | Denied | | |
| Missing permission | Denied | | |
| Expired token | Denied | | |
| Old credential after rotation | Denied | | |
| Issued token after secret revocation | Matches documented resource policy | | |
| Retired workload | Cannot perform operation | | |

Record consumer inventory, rotation evidence and retirement approval.