Original text:
identifier as a concept as well] A workload needs to obtain its identity early in its lifecycle.  This <del> identity is sometimes referred to as the "bottom turtle" on which further identity and security context is built. </del>  Identity bootstrapping often utilizes identity information provisioned through mechanisms specific to hosting platforms and orchestration services.  This initial bootstrapping information is used to obtain specific identity credentials for a workload.  This <del> process may use attestation to ensure the workload receives correct identity credentials.  An example of a bootstrapping process follows. </del>  arch-fig provides an example of software layering at a host running workloads.  During startup, workloads bootstrap their identity with the help of an agent.  The agent may be associated with one or more workloads to help ensure that workloads are provisioned with the correct identity.  The agent provides attestation evidence and other <del> relevant information to a server.  After obtaining identity credentials from the Server it passes them to the workload.  The server validates this information and provides the agent with identity credentials for the workloads it is associated with.  The server can use a variety of internal and external means to validate the request against policy. </del>  How the workload obtains its identity credentials and interacts with the agent is subject to different implementations.  Some common

Reviewer comments:
Fixed some of the wording and parallelism in the intro to keep the same ordering of X.509 certificates followed by Workload identity tokens. Generalized some of the phrasing. Removed concepts that aren't well defined in the document, such as "bottom turtle". I'm not opposed to adding these, I just don't think they make sense without an explanation of the analogy either inline or by-reference; so I tended towards keeping the document self-contained. Provided initial content for the Delegation and Impersonation, and Asynchronous and Batch Requests sections.

Revised text:
identifier as a concept as well] A workload needs to obtain its identity early in its lifecycle.  This  <ins> identity is the base identity upon which further identity and security context are built. </ins> Identity bootstrapping often utilizes identity information provisioned through mechanisms specific to hosting platforms and orchestration services.  This initial bootstrapping information is used to obtain specific identity credentials for a workload.  This  <ins> process may use attestation to ensure the workload receives the correct identity credentials.  An example of a bootstrapping process follows. </ins> arch-fig provides an example of software layering at a host running workloads.  During startup, workloads bootstrap their identity with the help of an agent.  The agent may be associated with one or more workloads to help ensure that workloads are provisioned with the correct identity.  The agent provides attestation evidence and other  <ins> relevant information to a server.  The server validates this information and provides the agent with identity credentials for the workloads it is associated with.  The server can use a variety of internal and external means to validate the request against policy. After obtaining identity credentials from the Server, the agent passes them to the workload. </ins> How the workload obtains its identity credentials and interacts with the agent is subject to different implementations.  Some common