Identity Graph
Connect every identity.Trace every path.
The identity graph links owners, identities, credentials, services, resources and actions into one queryable model — and extends it to the tools and entitlements that give AI agents their authority.
- Humanaccountable owner
- ownsNHI / Agentservice, workload, agent
- entitled toTool
- tool belongs toMCP server
- has credentialCredentialkey, token, certificate
- authenticates toService / APIcloud, SaaS, data
- can accessResourcebucket, table, repo
- performsActionread, write, delete, deploy
- authorizationDecisionallow · challenge · deny
Model
Relationships, not rows.
Four things the graph does that an inventory, a secret scanner or a permissions export cannot.
Why a graph, not a list
A list of secrets tells you something exists. A graph tells you who is accountable for it, what it authenticates to, what it can reach and what activity has been reported for it — the only form in which risk can be explained or fixed.
- Identity ≠ credential: the key is one node; the identity that holds it, the owner who answers for it and the resource it opens are others.
- Relationships carry the risk: an old key is a fact; an old key held by an orphaned identity with production reach is a finding.
- One model for every connector, so a GitHub App installation and a cloud role can be compared, traversed and governed the same way.
AKIA…7Qcloud access key611 downer: — · used by: ?ghp_…c3personal access token203 downer: — · used by: ?sk_live_…9fpayments API key88 downer: — · used by: ?xoxb-…2achat bot token412 downer: — · used by: ?
Tells you a secret exists. Not who holds it, what it reaches or whether it should.
- Platform teamaccountable owner
- ownssvc-billing-exportservice identity
- has credentialAKIA…7Qaccess key · 611 d
- authenticates toAWS IAM · prod-coreauthenticates to
- can accesscustomers_dbread + write
- executednightly exportreported through the ingestion API
Owner, identity, service, resource and action — with evidence on every edge.
What the graph knows about a credential
Every credential node carries its identity, its owner — or the fact that it has none — the services it authenticates to, the resources it can reach, its age, rotation, expiry and exposure. Each statement is backed by a source, and gaps are shown as unknown.
- Mapped to an identity and an owner, so a finding always has someone who can act on it.
- Reach, not just existence: which services accept it and which resources sit behind them.
- Lifecycle facts with evidence: age, rotation, expiry, reported exposure and — where the provider reports it — last use.
AKIA…7Q- belongs tosvc-billing-export · service identity
- owned byunowned — no owner tag, none assigned
- authenticates toAWS IAM · account prod-core
- can accesscustomers_db (read/write) · s3://exports (write) · 4 downstream services
- Age
- 611 days
- Last used
- 212 days ago · as reported by AWS
- Rotation
- overdue · never rotated
- Expiry
- none set
- State
- active · not revoked
- Exposure
- unknown — none reported through ingestion
Search, filter, traverse
Ask the graph questions a spreadsheet cannot answer. Filter by type, owner, age and status; traverse from any node to what it can reach; find the path between any two.
- Search and filters across identities, credentials, owners, services and resources.
- Traversal in both directions: from an identity outward to its reach, or from a resource inward to everyone who can touch it.
- Scoped by tenant, enforced by row-level security, so one tenant’s answers never include another’s.
Which agents hold a long-lived credential that nobody owns?
Which service accounts can assume a role in another AWS account?
Who owns every identity that can write to customers_db?
Which GitHub App installations can reach a public repository?
Which MCP tools with a write effect is an agent entitled to call?
Which inactive identities still hold an active credential?
Evidence on every edge
Each relationship records where it came from, when it was observed and how it is known — observed by a connector, or inferred from configuration. What nobody reported stays visibly unknown; they are never averaged into a confident-looking score.
If an edge cannot show its source, should it be in your risk score?
Why risk must be explainable- svc-billing-exporthas credentialAKIA…7Qobserved
- AWS IAM sync · 2026-08-19 06:00 UTC
- AKIA…7Qauthenticates toprod-coreobserved
- AWS IAM sync · 2026-08-19 06:00 UTC
- key issued in account prod-core
- svc-billing-exportcan accesscustomers_dbinferred
- role data-platform · inline policy statement
- an upper bound: conditions not evaluated
- ?ownssvc-billing-exportunknown
- no owner tag
- no owner assigned
Node types
Eight kinds of node. One vocabulary.
The graph uses the same types for every connector, so a finding means the same thing whether it began in a cloud account, a cluster, a Vault or an MCP server.
Human
A person who owns, approves or operates — the only node that can be held accountable
NHI
A service, workload, machine, integration or automation identity that acts with no person present
Agent
An AI identity with a profile and autonomy rating that holds credentials and is entitled to tools
Credential
A key, token, certificate or secret that lets an identity authenticate — never the identity itself
Service
A cloud account, cluster, Vault or MCP server that accepts a credential and grants access
Resource
A bucket, table, repository or workload an identity can reach through a service
Tool
An MCP tool an agent can be entitled to call, with an effect its publisher or an operator declared
Action
A specific operation on a specific resource: read, write, deploy, rotate, delete, pay
The identity graph is available today
Owners, identities, credentials, permissions and resources are modelled for every available connector, and credential age, rotation and expiry are available (M3). The agent extension — MCP tools and declared entitlements — is available (M6); agent-to-agent lineage is not built, by design.
See the full platform trajectorySee the graph built from your own identities.
On sample data or a scoped, read-only connector: discovery, the graph, a traversal and an explainable finding.