landing-zone-identity

Type: decision

Decision

Each landing zone has a single managed identity — shared across all its workflows, jobs, and service integrations.

Why

Without a single identity, every new capability multiplies the permission surface — RBAC and OIDC sprawl.

Violations

• Managed identity shared across multiple landing zones.

Links

• landing-zone-repo — OIDC federation relies on the landing-zone repo and environment scope.

← Back to knowledge graph