Thanks for your comment, it's interesting to hear what you guys have tried out. Absolutely, long-lived credentials are worse. The only advantage to long-lived/

Thanks for your comment, it's interesting to hear what you guys have tried out. Absolutely, long-lived credentials are worse. The only advantage to long-lived/file-sourced creds right now is granularity. Being able to lock them down to specific processes/UIDs and have a role per service. I guess what we want is the best of both worlds - short-lived per-service creds. It appears to be a difficult problem to solve. I was wondering if something could be done with kernel modules. Are you still working on this? Would really like to hear about future developments.