A credential has a lifecycle, not a moment
Issuing a credential well is necessary and not sufficient. A credential also needs a defined rotation cadence, a way to be revoked immediately outside that cadence if something goes wrong, and an actual retirement when the task or identity it was issued for no longer exists. Systems that treat issuance as the finish line tend to accumulate credentials nobody remembers granting, for identities that may not even be active anymore.
The retirement step is the one most often skipped, because nothing forces it: an unused credential does not announce itself the way a broken one does. Without a deliberate process — an expiry that isn't renewed by default, a periodic review that actually revokes what it finds — retirement only happens when someone goes looking, which in practice means rarely.
Designing for the compromise case, not just the happy path
A lifecycle designed only for the normal case — issue, use, eventually expire — is missing its most important branch: what happens when a credential is suspected of being compromised before its scheduled end. That path needs to be fast and well-rehearsed, not a special case improvised during an incident. If revoking a credential outside its normal schedule is a rare, manual, poorly understood procedure, it will be slower than an attacker needs it to be.