The scenario
Three years ago a data engineer created svc-ledger-sync to copy settlement records from the payments database into the analytics warehouse every night. The role it assumed was generous because the deadline was short: read on every table in the payments account, write to the warehouse and list on the backup bucket so the job could skip files it had already processed. The engineer moved teams, then left the company. Their laptop was wiped, their SSO account disabled, their open pull requests reassigned. Nobody thought about the service account, because offboarding is a process for people, not for the identities people create.
The nightly job still runs, and nobody is sure what would break if it stopped. The access key it uses was minted the week the job was written and has never been rotated. When a new analyst asks who approves a schema change that touches the sync, the ticket bounces between four teams before someone answers:we assumed it was yours.
Why it happens
- Offboarding stops at the human. Directory and HR workflows disable the person; the identities that person created are not linked to them anywhere, so nothing fires when they leave.
- Ownership was never recorded. The account was created in a console or a Terraform module with no owner tag, no stated purpose and no review date, so ownership has to be reconstructed from commit history and memory.
- Fear of breaking production protects the orphan. Without knowing what depends on the identity, nobody will disable it, so it accumulates tenure instead of scrutiny.
- It is the first category in the OWASP Non-Human Identities Top 10. OWASP lists improper offboarding as NHI1 because it is the most common way a long-lived, overprivileged identity comes to exist without anyone deciding that it should.
How Trustivan helps
Discover and classify the identity. The AWS connector inventories svc-ledger-sync as a machine identity in the payments account, with its role, its access-key metadata and, for roles, the last use AWS reports.
AvailableResolve the owner, or prove there is none. Ownership is read from provider tags or assigned by a person. When nothing supports an owner, the identity is recorded as unowned and the finding says so, rather than guessing.
AvailableAttach lifecycle to the identity. Lifecycle state — active, stale, orphaned, quarantined, decommissioned — is a property of the identity, and every change carries the evidence behind it.
AvailableShow what depends on it before you touch it. The identity graph maps the role, the tables and the backup bucket the account can reach, turning a risky disable into a decision with evidence.
AvailableRemediate from the finding. Assign an owner from the finding today. Scoping the role or replacing the static key can be proposed and approved by a second person; nothing executes it at the provider.
Available
What the evidence looks like
Every Trustivan finding answers the same nine questions, with the source records attached. For an orphaned identity the finding looks like this (illustrative):
| Question | Illustrative answer |
|---|---|
| Why | Service identity has no active owner and holds a live production credential |
| What | svc-ledger-sync · service identity · payments account |
| Who | Owner unknown: no owner tag on the identity, and nobody has assigned one |
| Where | Cloud account payments-prod · role ledger-sync-role |
| How | Static access key, age 1,087 days, no expiry; the role behind it last used 6 hours ago, as AWS reports |
| Blast radius | Read on 31 payments tables, write to the analytics warehouse, list on the backup bucket |
| Recommendation | Assign an owner, replace the key with short-lived federated credentials, scope the role to the 4 tables the job reads |
| Action | Owner assignment proposed to the data platform lead · owner notified in the platform |
| Evidence | IAM snapshot from the AWS connector · access-key metadata · role last-used timestamp · tag evidence |
Related capabilities
- Ownership & Lifecycle — accountable owners, attestation and an end of life for every identity
- Discovery & Inventory — inventory from five connectors: AWS IAM, GitHub, Kubernetes, HashiCorp Vault and MCP
- Identity Graph — owner, identity, credential, service and resource as one queryable relationship
- Decommission Tracking — decommission proposals with dependencies known; nothing executes at the provider
- Guide: mapping the OWASP NHI Top 10 to controls you can evidence