Identity, permission, and accountability are separate

Identity answers a narrow question: which entity is presenting a credential? Permission answers another: what is that entity allowed to do? Accountability adds who authorized the action, who can audit it, and who is responsible when the authorization changes. SPIFFE's concepts are useful background for workload identity, but a robot deployment needs an additional map. The physical device, software workload, human operator, vendor, and delegated authority should be recorded separately.

Draw the actors

List the physical robot, its software services, the organization that owns or operates it, the human roles that can grant access, and any vendor-controlled services. Do not merge these into a single identity merely because they are associated with the same product.

Make authority explicit

For each action, identify the credential used, the policy that permits it, the scope and lifetime, and the audit record. A device identifier does not prove that an action was authorized by a human or appropriate for a context.

Plan for change

Credentials expire, services move, operators leave, and devices are transferred or retired. An identity model is incomplete until the responsible party can revoke or reassign access and explain what evidence remains.