Non-Human Identity Access Review (QA)

Non-Human Identity Access Review (QA)

1. 01

   Inventory every non-human identity across client environments

   Catalog service accounts, API keys, and AI agent credentials in systems like Okta or JumpCloud, noting each one's owner, purpose, and last use date.

2. 02

   Map each identity to its actual resource permissions

   Compare the permissions each non-human identity holds against the minimum required for its function, flagging any that have broad or admin-level access without justification.

3. 03

   Check for shared or hardcoded credentials

   Search code repositories, config files, and documentation for embedded secrets or passwords, and verify that no two identities share the same credential.

4. 04

   Verify MFA and conditional access policies apply to non-human identities

   Confirm that service accounts and agent identities are covered by the same authentication policies as human users, or have compensating controls like IP allowlisting.

5. 05

   Review audit logs for anomalous access patterns

   Look for logins from unusual locations, off-hours activity, or repeated failed attempts that could indicate a compromised credential or misconfigured access.

6. 06

   Validate that offboarding and rotation procedures include non-human identities

   Ensure that when a client project ends or an employee leaves, associated API keys and service accounts are revoked or rotated within a defined timeframe.

7. 07

   Document findings and remediation plan for the client

   Summarize risks, list recommended changes, and assign owners and deadlines for each fix, so the client can track progress and maintain compliance.