The architecture diagram was the easy part. In Your SPIFFE workload can authenticate as an Entra Agent ID, but mind the trust gap , I argued that SPIFFE and Microsoft Entra Agent ID belong on opposite sides of a narrow trust contract. SPIRE proves which workload is running. Entra decides which governed agent identity that workload may use. A federated identity credential connects those statements through an exact issuer, subject, and audience match, which is how Microsoft Entra workload ide...