Explain the lifecycle of a service-to-service authentication in a Zero Trust mesh?

In a service mesh built for Zero Trust, service identity is issued and rotated automatically rather than relying on static, long-lived credentials.

1. When a workload starts, an agent (for example, a SPIRE agent) performs node and workload attestation, verifying the workload is what it claims to be based on runtime evidence rather than a hardcoded secret.
2. Once attested, the workload is issued a short-lived cryptographic identity document, such as a SPIFFE Verifiable Identity Document (SVID), typically valid for minutes rather than months.
3. When the workload calls another service, its sidecar proxy uses this SVID to perform an mTLS handshake with the peer's sidecar, mutually verifying both identities before any application data flows.
4. The mesh's control plane, such as Istio, enforces authorization policy scoped to that specific identity, deciding which calls between which identities are permitted.
5. The SVID is rotated frequently and automatically; if one were somehow leaked, its short validity window limits how long it remains useful to an attacker.

Every authenticated call is also logged by the mesh's telemetry layer, giving fine-grained, per-call audit visibility that static network-level logging never provided.