Conceptual
Login

An Instance Role Delivering Rotating Credentials Without Stored Key Files

The out-of-scope fence permits exactly one credential concept, and this is it: without an identity on the machine, no job in this curation can read its inputs or write its outputs. It is also what stops the learner from pasting a permanent key into the code they intend to publish, which would break the reproducibility clause.