ContactBook a demo

Classification

Know what it is.Know what it reaches.

An inventory tells you an identity exists. Classification tells you whether it matters: what kind of identity it is, where it runs, what state it is in, who owns it and how sensitive the resources it can reach are.

AvailableM2 · NHI classification
Book a demoStart with Discovery & Inventory

Type · account · lifecycle · owner · sensitivity — from evidence · unknown stays unknown

Illustrative classification · sample environment · unknown stays unknown until evidence fills it
IdentityTypeLifecycleAccountOwnerReachable sensitivity
aws-role/billing-exportIAM roleactiveprod-coreFinance platformdeclaredHigh
k8s/payments/workerKubernetes service accountactiveprod-paymentsPaymentsinferredHigh
github-app/deploy-webApp installationactiveplatform-orgWeb platformdeclaredModerate
vault-approle/ci-runnerAppRolediscoveredvault-stagingPlatformdeclaredModerate
github-bot/release-notesBotactiveplatform-orgDocsinferredLow
aws-user/legacy-exportIAM user · machinestaleprod-coreunknownunknown

Enriched fromProvider object kindProvider tags & labelsConnector accountSync historyOperator declarationsResource classification

Dimensions

Five attributes. Every identity.

Classification is the vocabulary the rest of the platform speaks — posture policies, risk and runtime authorization all read from it.

Type

IAM role, service account, workload identity, App installation, bot or AppRole — typed from the provider’s own object kind, never from a name

Account & lifecycle

The account, cluster, organization or Vault its connector covers, and a lifecycle state — active, inactive, stale, orphaned, quarantined or decommissioned

Owner & reachable sensitivity

The accountable owner — declared, inferred or unknown — and the sensitivity of the resources the identity can reach

How it works

Context comes from the provider, not from the name

Nobody tags ten thousand identities by hand. Attributes come from provider facts and tags, carry their sources, and an owner can be assigned by the people who know.

Evidence

Type from the provider, account from the connector, owner from tags

Every attribute is traced to where it came from: the object kind the provider reports, the account or cluster the connector covers, the tags and labels the customer wrote, and any declaration a person made in the product. Names are never read as truth — a role called svc-test is typed and placed by what the provider says it is.

  • Every attribute shows its source and whether it was provider-reported, declared or computed.
  • Owners can be assigned by a person when the tags are silent, and every assignment is audited.
  • Unknown stays unknown until a connector or a human fills it — no placeholder values, no guessed scores.
Data sensitivity

Classify by what the identity can reach, not by what it is called

svc-report-reader sounds harmless until you see it can reach the customer table. A resource's sensitivity is recorded with its basis — provider-reported, tag-declared or operator-declared — and an identity's reach is computed on the graph as an upper bound, so high-impact access reflects consequence rather than naming conventions.

  • Resource impact is a stated classification, provider-reported, tag-declared or set by an operator — never guessed from a name.
  • Unclassified resources stay unclassified: they are never counted as low.
  • Sensitivity feeds risk as the sensitive-resource-access factor, shown with its evidence.
See how blast radius is computed
Human use & reuse

Separate the machine from the human behind the keyboard

A classification system should never list a person as a service account. So AWS console users are excluded, and the GitHub connector leaves out machine users of type User — GitHub cannot tell them from people. Where one credential serves several agents, the product says so instead of counting it once.

  • Machine-oriented identities only: console users and GitHub users of type User are left out rather than guessed.
  • Human use of an NHI is not detected — no connector collects the sessions that would show it.
  • One credential, many agents is raised as agent_credential_shared rather than counted as one identity.
Read the OWASP NHI Top 10 mapping

What you get

A classified population you can write policy against

Once every identity carries type, account, lifecycle and owner — and every resource its sensitivity — posture and risk stop being manual triage.

Typed inventory

Every identity carries a type from the NHI taxonomy, from service account to MCP server

Evidence per attribute

Every classification carries the provider fact, tag or declaration it came from, so a reviewer can check it

Lifecycle states

Discovered, active, inactive, stale, orphaned, quarantined and decommissioned, from sync and ownership evidence

Owner confidence

Owners from provider tags marked declared or inferred, assignable by a person, and unknown when nothing says

Resource sensitivity

Sensitivity from provider facts, resource tags or an operator’s declaration — each basis recorded

Policy-ready views

Filters such as unowned, stale and high-impact access that feed posture policies and risk

Example

When the label and the reality disagree

Misclassification is a risk in itself: a production identity treated as disposable gets neither an owner nor a review.

HighMisnamedHigh-impact accessProduction

Identity named as a test account is carrying production access

Why
An identity whose name says “test” sits in a production account and can reach resources classified high impact
What
aws-role/analytics-test (IAM role)
Who
Owner: unknown — no Owner tag, and nobody has assigned one
Where
AWS account prod-core (from the connector)
How
Its trust policy lets the analytics workload assume it; AWS reports it last used 2 days ago
Blast radius
Read on 2 resources classified high impact · effective access, an upper bound
Recommendation
Assign an owner, confirm what uses it, scope the inline policy to the reporting resources
Action
Assign owner · propose remediation for second-person approval
Evidence
IAM snapshot · role last used (AWS-reported) · resource classification record
Nine questions, source records attached. Missing evidence is shown as unknown.Illustrative finding · sample environment

Related capabilities

Classification feeds everything downstream

Ownership routes by owner, posture weighs by reach, rotation findings land by account.

All solutions

Classify every identity by what it can reach.

See how TRUSTIVAN connects identity, credential, access, agent and action context into one control plane.

Book a demo