@@ -1329,7 +1329,7 @@ The rotation can replace keys or tokens to limit exposure from compromised crede
It can be built on top of existing authority structures, or it can re-run some parts of the device initialisation procedures.
How the retake of the authority is implemented is between the product and the device.
***AAC_MACHINE-1** The product shall provide passwordless authentication for machine users such as certificates or tokens.
***AAC_MACHINE-1** The product shall provide authentication for machine users such as certificates or tokens with an expiration date, mutual TLS with per-subject certificates, signed short-lived assertions/credentials like client assertions or workload identity, or equivalent asymmetric-key-based authentication; excluding static shared secrets and long-lived bearer tokens.
***AAC_MACHINE-2** The privileged interfaces like APIs shall minimise access permissions for the machine user.
