1. TF CODE 2. IAM / SA 2. POOL/IDP 3. FEDERATE 4. GET TOKEN 5. LEAST PRIV 1. READ KEY 2. BROAD SCAN DEV REPO (TF) TERRAFORM APPLY IAM BINDINGS & SA WORKLOAD IDENTITY AIKIDO SCANNER SHORT-LIVED TOKEN STATIC SA KEY GCP RESOURCES (NARROW SCOPE) GCP RESOURCES (BROAD ACCESS)