Your identity programme governs your employees. It does not govern everything else with a credential.

Every human identity has a lifecycle. Service accounts, API keys and integrations are created by whoever needed them, and there is no equivalent of leaving. When a person exits, the credentials they stood up remain — with their authority and without their accountability.

We enumerate the population across directory, cloud, database and integration layers, and record a named accountable owner for each. Where no owner can be identified, that finding is itself the result.

Joiner-mover-leaver is the control your institution already trusts. It was written for employment events, so a credential created for an integration never joins, never moves and never leaves.

We define the equivalent events for non-human identities — creation with an owner and a purpose, change on system or ownership transfer, retirement on decommission — and set out how existing processes absorb them without new tooling.

Access recertification is the primary compensating control in every regulated institution. Non-human identities have no manager to attest and no review cadence. The control auditors rely on does not cover the fastest-growing population.

We establish what would have to be true for these identities to be attestable — owner, purpose, expected behaviour, evidence of use — and where current records fall short of that.

Segregation of duties assumes two actors. A single service or agent that can both initiate and approve collapses that into one identity, without triggering any control designed to detect it.

Software also holds the union of every privilege it might need and, unlike a person, exercises all of it continuously. Excessive privilege stops being latent risk and becomes active behaviour. We identify where that has happened in the processes your regulator examines.