Most of the Accounts We Manage Will Not Belong to People

Description and use

Identity governance designed for humans fails for service accounts and tokens. The adopted approach assigns a human owner, purpose, and expiry to each non‑human identity, enforces automatic expiration, and audits actions.

Problem

Identity governance systems designed for human users fail to manage the growing number of non‑human accounts (service accounts, API keys, tokens, certificates) that lack start dates, managers, and natural expiration.

Outcome

Governance of non‑human identities became systematic, with clear ownership, purpose, expiry, and action‑level permissions, improving auditability and reducing risk of stale or unauthorized access.

Workflow

• Identify all non‑human accounts in the directory.
• Assign a human owner and system owner to each account.
• Define a purpose and an expiry date for each token or service account.
• Configure credentials to expire automatically and require renewal.
• Grant permissions on a per‑action basis rather than per system.
• Update logging to capture the human author of each action.
• Schedule regular reviews to ensure owners and expiry dates remain current.

Evidence

Every non‑human identity gets a named human owner, a system it belongs to, a purpose and an expiry date.

Source