On a related note; if you're still considering whether you should put passwords, or rather, hashes thereof—in your application database of choice—please, decide

On a related note; if you're still considering whether you should put passwords, or rather, hashes thereof—in your application database of choice—please, decide against doing so at all costs! Instead, you should probably use a dedicated secret management deployment: think Hashicorp Vault[1], OpenBao[2], or Keto[3] if you'd like to go beyond with ReBAC (Relationship-based access control) of Google's Zanzibar[4] fame. The benefits of a HA deployment like this far outweigh the upstart integration costs as you get to use a single, shared frame of reference to reason about your internal and external resources alike. Customer passwords, passkeys, certificates, internal CA, ACME, at-rest, in-transit, what have you, is controlled from a single point of consumption with one policy space to rule them all. It helps to use dedicated HSM capability, too. In cloud environments, AWS Nitro enclaves exist now; you could put something like Vault inside one[5]. Vault is more or less Old Testament, though, so if you're serious about zero trust, Zanzibar paper is a must-read! Relationships lend nicely to AI agent stuff, where RBAC is putting you at a disadvantage. It's hard to express both direct and indirect access patterns in RBAC. For example, whenever agents would act on your, or your user's behalf within a clearly-defined scope (sic!) This is where traditional RBAC breaks down, whilst ReBAC really shines for expressing relationships between user/agent/system identities, thus greatly simplifying checking, scoping, audit. [1]: https://developer.hashicorp.com/vault https://developer.hashicorp.com/vault [2]: https://openbao.org/ https://openbao.org/ [3]: https://www.ory.sh/keto https://www.ory.sh/keto [4]: https://research.google/pubs/zanzibar-googles-consistent-global-authorization-system/ https://research.google/pubs/zanzibar-googles-consistent-glo... [5]: https://edgebit.io/enclaver/docs/0.x/guide-vault/ https://edgebit.io/enclaver/docs/0.x/guide-vault/