Non-Human Identity Inventory and Secrets Rotation (Delivery)

Non-Human Identity Inventory and Secrets Rotation (Delivery)

1. 01

   Enumerate every non-human identity touching the client environment

   Pull service accounts, API keys, OAuth tokens, CI/CD secrets, and AI agent credentials from the IdP, cloud consoles, and secret stores. Tag each with owner, purpose, and last-used date.

2. 02

   Classify each identity by blast radius and data sensitivity

   Score identities on what they can reach (production data, client PII, billing systems) and whether they are human-adjacent or fully autonomous. Identities with write access to client systems get the highest tier.

3. 03

   Map secrets to their storage location and rotation mechanism

   Record whether each secret lives in a vault (1Password, Bitwarden), an environment variable, or hardcoded in a repo. Note the rotation cadence and who holds the rotation authority.

4. 04

   Rotate any secret older than 90 days or lacking an owner

   Prioritize credentials with production access. Use the vault's built-in rotation where available; otherwise schedule a manual rotation window with the client's IT contact.

5. 05

   Enforce least-privilege scopes on every non-human identity

   Strip wildcard permissions and unused scopes. For AI agents, restrict tool access to the minimum set required for the assigned task, and log every scope change.

6. 06

   Configure alerting for anomalous non-human identity behavior

   Set thresholds for off-hours access, volume spikes, and new IP ranges. Route alerts to the agency's on-call channel and the client's security contact.

7. 07

   Document the inventory and rotation log in the client's delivery workspace

   Store the inventory as a living document with a review date. Include the rotation history and the named owner for each identity so the next delivery cycle starts from a known state.