A mechanism that lets external workloads (CI/CD pipelines such as GitHub Actions, applications on AWS or Azure, or on-premises systems) exchange their OIDC or SAML token for short-lived Google Cloud credentials, without service account keys.
On the ACE it is the answer when a policy forbids storing service account keys outside Google Cloud. GKE has a variant, Workload Identity Federation for GKE, so Pods get their own permissions.
Workload Identity Federation is a concept that can show up on the exam. Check the full guide to see it in context.