WinMagic WinMagic WinMagic The WIMSE architecture binds a workload credential to a cryptographic key presented with proof of possession, and leaves credential lifetime and rotation to the implementation. In common practice the binding key is held in software and rotated frequently, because a software key can be copied: rotation is a compensating control for a key that can be exfiltrated. This document defines a profile in which the binding key is hardware- rooted and non-exfiltratable, and in which credential validity is gated by attested conditions -- the workload and its required posture being measured and present -- rather than by a fixed expiry. Two consequences follow. Frequent rotation is no longer required to bound exfiltration, because the key cannot leave the hardware boundary. And a grant cannot outlive the workload, even with no expiry date, because the key, and with it the ability to prove possession, is gone once the workload or its conditions cease to hold. Condition failure is therefore enforced by the key's absence rather than by a revocation message, and the credential can be appraised without a live connection to its issuing authority. The profile is specified against a verifier contract -- authority, live-instance, condition, freshness, and fail-closed checks -- that other credential profiles can share, so these properties are made explicit and reviewable without standardizing a single credential format or hardware recipe. It is offered as one conforming way to instantiate WIMSE credentials, suited to stable, attestable platforms, and is explicitly not proposed for high-churn, hardware- less workloads.