A new key was added to the vault.
Identity & access / 08
Non-human identities
Expose ownerless keys, excessive privileges and rotation dependencies.
This work is currently open on this device. Sign in to save it and continue on another device.
Sign inService accounts, workload identities and API keys do not behave like human accounts. MFA alone does not explain automation security; ownership, issuance context, least privilege and revocation matter. Where supported, managed or short-lived identities can reduce long-lived secrets. Verify product support and workload compatibility.
Map the process
0 / 4 steps reviewed.Step 1 / 4
Assign identity ownership
Link workload, business/technical owners, environment and last use. Verify whether an apparently unused identity supports a periodic critical job. Do not blindly delete ownerless identities.
Expected evidence
Identity–workload–owner record
One control, three perspectives
What consumes this identity?
Validate dependencies before rotation.
Consumers and rotation testEvaluate evidence
Claim: The old key is disabled.
What evidence would you request before closing this claim?
Decision desk
Two environments share a service key with no known owner.
First decision?
Worked example
This record is fictional. Do not treat sample results as evidence for your own work.
| Masked ID | Workload | Owner | Permission | Consumer | Revocation test |
|---|---|---|---|---|---|
| svc-***-21 | Example transfer job | Data platform owner | Write to destination only | Synthetic batch job | Old identity rejected |
Closure checklist
0 / 4Checks on this screen last for this session only; they do not create closure evidence or compliance approval. Keep organizational records in the downloaded workpaper.
Take it to work
Files in the selected language. The workbook includes blank records, a worked example and a checklist.
Keep learning
Explore related Academy coursesSources and edition
Checked: 2026-10-21 · Edition 2026.10