We counted our identities properly for the first time this year. Fourteen hundred staff accounts. A little over four thousand that are not people: service accounts, integration users, API keys, certificates used for authentication, tokens held by automation, and a growing number of things that exist to let one system act inside another.
That ratio is not unusual and it is moving in one direction. Every integration we build adds identities. Every automated job needs to be something. Every managed service authenticates as itself. And the assistants now appearing inside our platforms act on a user's behalf while presenting as something else entirely in the log.
The governance we have was designed for people, and it depends on facts that only people have. Joiners, movers and leavers works because human resources is an authoritative source that knows when somebody starts and stops. Access review works because a manager can be asked to confirm that a named individual still needs something. Both assumptions fail completely for a token. There is no start date, no leaving date, no manager, no one who will notice it has gone unused for three years, and no natural moment at which anybody is prompted to think about it. Ours had a median age we could not calculate, because a third of them had no record of creation at all.
What I expect over the next decade is that this becomes the main body of identity work rather than a side case, and that the pressure arrives from assurance before it arrives from engineering. An auditor asking who authorised an action is not satisfied by the name of an integration account, and as more actions are initiated by software acting under delegated authority, attribution becomes genuinely difficult. The question stops being who has access and becomes on whose behalf, under what instruction, and with what expiry.
The practical work is unglamorous and available now. Every non-human identity gets a named human owner, a system it belongs to, a purpose and an expiry date. Credentials expire by default and renewal is deliberate. Scope is granted per action rather than per system. Logs record the initiating person, not only the account used.
Our directory is still built on the assumption that an account is a person. That stopped being true some time ago, and everything above it inherits the error.
– Serguey Shinder
