Non-human identities outnumber people by an order of magnitude
Service accounts, workload roles, CI/CD principals, integration keys and agent credentials constitute the majority of the identity population in every cloud estate we assess. They rarely expire, they are frequently over-permissioned at creation, and they almost never have a named human owner after the original project closes.
Any least-privilege program that starts with human accounts starts with the minority of the problem.
Effective permission, not attached policy
Entitlement analysis must evaluate the full decision: identity policies, resource policies, permission boundaries, session policies, conditions, and cross-account trust. Two identities with identical attached policies can have entirely different effective reach.
Escalation paths matter more than individual permissions. The ability to modify a role, attach a policy, assume another principal, or update a compute instance profile converts a limited identity into an unlimited one in a single step.
- Compute effective permissions per identity, per resource, per condition
- Enumerate escalation primitives explicitly and treat them as critical findings
- Inventory key and token age, with rotation evidence
- Assign a human owner to every non-human identity as a hard requirement
Right-sizing from observed usage
Least privilege becomes practical when the proposed policy is generated from observed usage over a representative window and presented as a diff against the current one. The owner reviews a concrete change, not an abstract principle.
Two guardrails make this safe: a minimum observation window that covers periodic jobs, and a shadow mode that reports what the tighter policy would have denied before it is applied.
Detection for the identity layer
Reduction lowers the ceiling; detection covers the remainder. The highest-value identity detections are impossible-travel and unusual-client sessions, first-time privileged API usage per principal, escalation primitive invocation, and credential usage from a network path the identity has never used.
- Baseline per principal, not per organization
- Alert on first observed use of escalation primitives, always
- Correlate identity anomalies with workload and data events before paging
