Ask HN: Attestation-Based Identity: does this direction make sense? (EnvSecOps)

I’m proposing Attestation-Based Identity (ABI) as the category and EnvSecOps as the operating discipline.

Basically Zero Trust operationalized for the ENTIRE SDLC, from dev all the way to production support.

ABI: Issue credentials only when a requester presents fresh, nonce-bound evidence that passes policy, then expire quickly. Evidence → Policy → Token, with a tamper-evident audit trail.

EnvSecOps: The practice of governing access by verifying environment provenance at request time across dev, ops shells, and workloads—.

What I have (research/reference only): A small, spec-first reference implementation demonstrating the flow: capture/sign DSSE → OPA evaluate → short-lived OIDC/STS → optional Rekor inclusion → evidence bundle (token ↔ attestation ↔ policy version ↔ log entry). It’s not public yet; goal is a portable on-wire spec not a product.

Feedback I’m seeking:

Predicate must/should fields (materials digests, policy ref/hash, nonce, audience, signer identity).

Minimal, swappable PDP contract (deterministic inputs/outputs).

TOCTOU defaults: acceptable drift window, renewal cadence, revocation hooks.

Boundary with SPIFFE/SPIRE (workloads) and a clean model for ops-shell identity.

Auditor-friendly evidence bundle and reporting expectations.

Happy to answer questions; I’ll publish artifacts once the spec is less volatile.