What is workload identity federation?
In short:Workload identity federation lets a workload in one environment use its native identity to get credentials in another, with no stored keys. A cloud trusts tokens issued by another platform. It is how many agents avoid long-lived cloud keys when they run outside the cloud they call.
How does it work?
The workload presents a token from its home platform; the target exchanges it for a short-lived credential.
What does it look like in practice?
An agent running in a CI pipeline gets a short-lived cloud credential from its pipeline token.