Immutable identity is a permanent identifier that stays the same even if a repository, project, or account display name changes. Unlike a human-friendly label, it is meant to be stable, unique, and safe for systems to trust over time.
In cyber security, immutable identity matters because authorization should follow the thing that truly owns a resource, not a name that can be edited, reused, or reassigned. If a package registry, CI system, or cloud service binds trust to a mutable label, an attacker may exploit that gap to publish code, request credentials, or impersonate a legitimate workflow under the wrong name. Defenders reduce this risk by checking stable IDs, not just repository names, and by using identity-aware controls such as OIDC claims, publisher allowlists, and provenance checks. In supply-chain security, immutable identity helps ensure that a release really came from the trusted source the system intended to approve.