Make-Before-Break Credential Rotation
Two valid credentials overlap briefly so the agent never has zero.
time
Credential A — valid
Credential B — issued & validated
both valid — zero downtime window
A revoked here
agent using A
overlap window
agent using B only