tion" aria-labelledby="workload-principal"><p>Identifies the verifiable authority under which a <a href="#workload">workload</a> runs. Istio’s service-to-service authentication is used to produce the workload principal. By default workload principals are compliant with the SPIFFE ID format.</p><ul><li>Multiple <a href="#workload">workloads</a> may share the same workload principal, but each workload has a single canonical workload principal</li><li>Workload principals are accessible in Istio configuration