Machine-to-machine trust

Services authenticate to each other with credentials nobody types and nobody watches.

That means they persist for years, get copied between environments, and their misuse looks exactly like normal operation. There is no user to report something odd. Short-lived, workload-bound identity is the answer and it requires the infrastructure to support it.