OIDC Trust Policy: Exposure Timeline Simulator

Timeline legend

Legit CI request / credential Untrusted request — leaked Untrusted request — blocked

Traffic

Legit CI job rate 30/min

Untrusted workload rate 18/min

Trust Policy

Subject scope 40% pinned

Credential TTL 60s

Live Readouts

Legit granted

Untrusted blocked

Untrusted leaked

Live leaked creds

R (analytic) ≈ 0.00 · L̄ (measured) ≈ 0.00 cred·s/s

How it works

This is the 2D counterpart to the 3D trust-chain visualization — same OIDC keyless-CI/CD trust model, but computed and drawn as a genuine time-series / queueing simulation instead of packets flying through a rendered 3D network. Untrusted workload requests are generated as a true Poisson process — inter-arrival times drawn as -ln(U)/λ, not a per-frame accumulator — and each one is independently thinned by the trust policy: granted with probability 1 − scope, blocked otherwise. A granted request mints a credential with an exactly deterministic lifetime, TTL seconds, making this an M/D/∞ infinite-server queue.

The scrolling top strip is a live event log: every arrival is a tick, every granted credential a horizontal bar spanning its exact lifetime. The chart below plots L(t) — the number of currently-live leaked (untrusted) credentials — against elapsed time.

arrival:  t += -ln(U)/λ_untrusted        (Poisson process)
grant:    keep with prob. p = 1 - scope     (independent thinning)
lifetime: credential expires at exactly t + TTL

Little's Law (M/G/∞):  L̄ = λ_granted · T = λ_untrusted·(1-scope)·T

Thinning a Poisson process keeps it Poisson at the reduced rate λ_untrusted·(1−scope), and for an infinite-server queue with any i.i.d. service-time distribution, Little's Law says the long-run mean number in system equals arrival rate times mean sojourn time — exactly, not an approximation. The chart's dashed line is that closed-form R; the solid line is the simulator's own running time-average of L(t), computed independently by numerically integrating live-credential-seconds and dividing by elapsed time. Watch it converge onto the dashed line as the run gets longer — that convergence is the proof that pinning the subject scope toward 100% (or shortening the TTL) drives real leaked-access exposure toward zero, exactly as the formula predicts.