ECZ-ID Workload Trust

Review service/workload deployment, identity and federation evidence before a machine or operator relies on it.

Free, local-first. No account is required for a workspace review, and source code, credentials, cloud-account identifiers and secret values are not uploaded.

Useful for

• platform, cloud and SRE teams
• service and workload owners
• identity/security architects reviewing workload federation
• organisations that need one durable identity across deployments and infrastructure changes

What it looks for

ECZ-ID Workload Trust reviews local deployment descriptors, service/workload identity references, federation/OIDC/SPIFFE-style references, Kubernetes service-account context and related repository evidence. Results are evidence observations, not an access or compliance decision.

What you can do in under a minute

1. Open a trusted workspace containing the service or workload configuration.
2. Run ECZ-ID Workload Trust: Review Workspace.
3. Review observed and not-observed evidence locally.
4. Resolve existing proof, request current proof, or create/connect the free Service & Workload Passport when you operate the subject.

Example use cases

• Review workload-identity references before connecting a service to privileged infrastructure.
• Organise deployment/federation evidence before an enterprise architecture review.
• Re-check after a service origin, repository or workload identity changes.
• Give a service/workload one persistent ECZ-ID identity while deployment instances continue to change.

Result semantics

Results use neutral states such as observed, not observed, review recommended and re-check before reliance. Local policy decides sufficiency.

The free Service & Workload Passport identifies the subject. It does not grant access or certify the workload. Workload Identity Federation, managed lifecycle/currentness and stronger Parent verification remain separate optional operating layers.

Privacy & permissions

Free vs operating services

• Free: local evidence review and permanent core Service & Workload Passport identity.
• Optional paid layer: workload federation, managed currentness/lifecycle and stronger Parent verification where required.
• Paid operations never replace or meter the underlying free identity.

Machine-readable facts

First use

Install ECZ-ID Workload Trust, open a trusted workspace, then run ECZ-ID Workload Trust: Review Workspace from the Command Palette.

ECZ-ID is independent trust infrastructure. Third-party names describe compatible ecosystems only and do not imply endorsement or affiliation.