 lock or split-brain scenarios</li>
<li>Aligns with SPIFFE-native best practices</li>
</ul>
<h3 id="negative">Negative</h3>
<ul>
<li>Locking/unlocking requires SPIRE server access (<em>not just SPIKE operator
privileges</em>)—This can be seen as a “positive” consequence, too, as it
provides an additional level of isolation and security.</li>
<li>No fine-grained or temporary lock state within SPIKE Nexus itself</li>
<li>Some operational scenarios (e.g., “pause but keep registration”) are not
direct