Separate fail-closed bootstrap from narrow policy rotation

A declarative bootstrap that creates missing resources and fails closed on drift should not be reused to rotate an existing Cloudflare Access policy's service-token ID: refusing drift is its safety contract. Use a separate, narrowly scoped rotator that GETs the current policy, validates immutable fields and the exact expected old token ID, PUTs only the intended replacement while preserving every other field, then GETs and verifies the effective policy. Finally rerun the full declarative plan validation. This pattern does not authorize broad policy rewrites and is unsafe when the current state, old ID, or replacement identity is ambiguous.

Applies when: A credential rotation must update one identifier inside an otherwise immutable access policy. Keywords: Cloudflare Access policy service token rotation drift GET PUT verify bootstrap