# Workload identity trust policies govern CI/CD access to production cloud resources

DevFeed: [Workload identity trust policies govern CI/CD access to production cloud resources](<https://devfeed.tech/articles/your-most-privileged-identity-has-no-login-16073.md>)

Original publisher: [Read original article](<https://workos.com/blog/workload-identity-trust-policies>)

Author: WorkOS

Published: 2026-09-02T00:00:00Z

Content type: article

Language: en

Sources: [WorkOS Blog](<https://devfeed.tech/sources/workos-blog.md>)

Topics: [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>)

Tags: [aws](<https://devfeed.tech/tags/aws.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [github](<https://devfeed.tech/tags/github.md>), [identity](<https://devfeed.tech/tags/identity.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [policy](<https://devfeed.tech/tags/policy.md>), [production](<https://devfeed.tech/tags/production.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [trust](<https://devfeed.tech/tags/trust.md>)

## AI overview

This article explains that workload identities used by service principals and CI/CD federation can evade human-focused access reviews. It argues that OIDC trust policies are the key boundary controlling which federated jobs can obtain short-lived cloud access tokens and reach production resources.

## Source excerpt

Service principals and CI/CD federation skip the access reviews that catch humans. The OIDC trust policy string is what actually decides who reaches production.