Status is a security decision

Credential status often captures security and business decisions: active production use, revoked access, expired credentials, pending approvals, or emergency exceptions. A migration script that creates credentials and leaves them in a default approved state can accidentally reverse those decisions.

Migration pattern

Extract credential metadata from Edge and treat status as a required migration field. If target APIs do not support a direct one-step equivalent, apply a two-step process: create the app and credential, then set or revoke status according to the source manifest. Confirm with negative tests that revoked credentials fail exactly as expected.

Evidence to retain

  • Source credential ID and target credential ID mapping.
  • Before and after status values.
  • Product association status by credential.
  • Validation result for active and revoked scenarios.

Credential migration is complete only when access intent is preserved, including denied access.