EMS automation jobs retrieve vault credentials that stop working after a configured interval even though nobody revoked them. What CI secrets concept explains this?

EMS automation jobs that retrieve vault credentials which stop working after a configured interval—even though nobody revoked them—are hitting lease expiry that requires renewal instead of an infinite secret lifetime. Vault leases grant credentials for a TTL; when the lease expires without renewal, access stops by design. That is a CI secrets concept distinct from manual revocation: expiry is scheduled lifetime management to avoid immortal credentials in municipal automation.

Infinite secret lifetime with no renewal requirements fails by concept: it describes the anti-pattern the symptoms contradict. SBOM generation automatically extending every credential forever fails because SBOMs inventory software components; they do not renew vault leases. Artifact immutability deleting vault entries on each successful build fails causation: immutable artifacts prevent bit replacement in registries; they do not unilaterally delete vault leases after builds.

Exam caveat: distinguish lease expiry (TTL) from explicit revoke and from password rotation policies. Jobs with long runtimes may need periodic lease renewal APIs; ignoring renewal produces exactly “it worked, then stopped without revoke.”

Operational check: set vault TTLs intentionally for EMS jobs, implement renew-before-expiry in long runners, alert on lease expiry errors, avoid infinite credentials, and document that sudden mid-job auth loss after a fixed interval is a lease problem before assuming IdP outage.