Short-lived credentials and vending

Why does a short TTL replace revocation, and how does credential vending narrow the waist?

This is the cleanest derivation here.

Revocation (cancelling a credential before it expires) requires the verifier to consult changeable state at the time of validation: "is this token on the revoked list?" So you cannot have stateless verification and immediate revocation at the same time. That is a cache-invalidation problem wearing a security costume. Stateless verification is what lets a system scale, so the way out is to make revocation unnecessary by making the lifetime short.

If the chance of compromise per unit of time is roughly constant, then the expected exposure scales with the TTL. A TTL of minutes makes expiry a substitute for revocation.

You have traded a correctness problem for a throughput problem. That is the rule "costs are relocated" exactly. And the throughput is governed by Little's Law: the average number of items in a system equals the arrival rate times the time each stays.

Vending: minimal in three dimensions

Credential vending means a vending authority holds a broad credential and mints narrow ones on request. Narrow means minimal in three dimensions, not one:

• Time (TTL),
• Authority (which objects: this table, this file prefix),
• Audience (which verifier will accept it).

The structural achievement: it lets the narrow waist sit at the storage layer while the policy stays in the catalog. The storage service enforces on credentials it can verify; the catalog knows the policy; the vend is the join between the two. This is why several independently designed table-format catalogs converged on scoped credential vending. It is the only construction that closes the "direct file access" hole (Mateus's problem) without giving every query engine god-mode storage keys.

Example. Mateus's query runs. The engine asks the catalog: "Mateus wants visits." The catalog checks policy and returns a credential that can read only the files of visits that hold Northern partitions, valid for 15 minutes, accepted only by that storage account. Even if Mateus's notebook is compromised, the credential does not open other regions.

The costs are real:

• The vending service is a hot-path availability dependency: you bought coordinated authority at the price of coupling (if it is down, nothing starts). Its compromise is total, since it holds the broad credential.
• Issuing per request has a fixed cost, so you batch: one credential per job instead of one per file. This is the security form of the rule "fixed cost sets the batch size". And the batch is the blast radius.

In one sentence: the batch size of a credential is its blast radius, and a short TTL is the only knob that makes expiry cheaper than revocation.