One set of permissions.
Every provider.

No long-lived key, anywhere

Cloud accounts are connected through federation: a cross-account role on AWS, a service principal on Azure, workload identity on GCP. Lakefront holds no credential it could replay, and every action it takes is signed for that request and that request only.

• Scoped to the resourceDeploy this service, read those secrets, nothing wider.
• Revoke in one clickPull a grant and it is gone from every provider at once.
• One audit trailAzure, AWS and GCP actions in a single, queryable timeline.

Just-in-time elevation

Standing production access is the thing that eventually hurts you. Lakefront models eligible roles the way Azure PIM does: you activate a role when you need it, optionally through approval, and it expires on a clock rather than on your good intentions.

• Eligible, not assignedThe permission exists; the grant does not, until you ask.
• Approval policiesRequire a second person for the roles that deserve one.
• Cloud accounts are a scopeUsing a connection is itself a permission, not a side effect of being an admin.

Secrets that rotate themselves

Each environment gets a Key Vault in your own account. Rotation generates a new version, runs both versions briefly so nothing in flight breaks, then revokes the old one. Values are encrypted at rest with a key you control.