Access Reviews

Access through Non-Human Identity (NHI) occurs when a synthetic subject authenticates or acts using a machine, service, workload, application, or agent identity rather than a direct human login. This may include service accounts, application credentials, OAuth tokens, Application Programming Interface (API) keys, cloud roles, connector credentials, or Model Context Protocol (MCP) server secrets.

This configuration creates an elevated exposure condition because the synthetic subject’s practical capability is defined by the identity and credentials assigned to it. If those credentials are shared, long-lived, over-scoped, or poorly inventoried, the synthetic subject may gain standing access that is difficult to attribute, revoke, or monitor.

The primary risk is unmanaged authority. A synthetic subject may retrieve data, call tools, send messages, update records, or perform workflow actions through credentials that exceed its intended purpose. Where multiple agents share one service account or hard-coded secret, investigators may be unable to determine which synthetic subject acted, which workflow invoked it, or which system granted the access.

Investigators should review the synthetic subject’s assigned identities, credential storage, token lifetime, scopes, authentication logs, service account ownership, vault records, repository secrets, configuration files, and access review history. Particular attention should be given to shared service accounts, orphaned tokens, hard-coded secrets, dormant credentials, privileged scopes, and identities not represented in asset or identity governance inventories.

Investigative Relevance

Access through Non-Human Identity is relevant because identity configuration determines what a synthetic subject can access and perform. Weak NHI configuration may turn a limited assistant, embedded feature, or agent into a privileged actor with access beyond its operational purpose.

Access through human identity occurs when a synthetic subject is configured to use a human employee’s account, session, token, credentials, browser profile, or delegated permissions to access systems or perform actions. This may occur where an employee connects an artificial intelligence tool to their mailbox, browser, source repository, cloud console, productivity suite, or business application using their own identity.

This configuration creates an elevated exposure condition because the synthetic subject inherits the employee’s access, trust, and attribution trail. Actions taken by the synthetic subject may appear in logs as ordinary human activity, even where the employee did not review each action or understand how the synthetic subject used their access.

The primary risk is identity inheritance. The synthetic subject may retrieve data, send messages, modify records, run commands, or trigger workflows using permissions granted to the human account. This makes it difficult to distinguish direct employee behavior from AI-mediated action.

Investigators should review authentication sessions, OAuth grants, connected applications, browser extensions, delegated permissions, endpoint activity, application logs, prompt and response records, tool-call logs, and user activity timelines. Particular attention should be given to AI tools operating inside authenticated user sessions, personal automation scripts, browser agents, local coding assistants, and third-party AI services connected through employee-granted access.

Investigative Relevance

Access through human identity is relevant because it defines what a synthetic subject can do by borrowing the reach of a human account. This weakens identity-based investigation, access governance, and containment because disabling or restricting the synthetic subject may require examining the employee’s sessions, devices, integrations, and delegated grants.

Persistent memory access is the configuration that allows a synthetic subject to store, retrieve, or act on durable memory across sessions, users, tasks, or workflows. This may include long-term memory, shared memory, user memory, vector memory, profile memory, task state, scratchpads, or context stores.

This configuration creates an elevated exposure condition because stored memory can influence future behavior after the original interaction has ended. If memory writes are not governed, attributed, reviewed, isolated, or time-limited, a synthetic subject may later act on false assumptions, malicious instructions, sensitive records, or outdated context.

The primary risk is memory poisoning. A user, external content source, compromised integration, or prior agent interaction may cause harmful content to be written into memory. That memory may then be retrieved in a later session and influence the synthetic subject’s reasoning, output, tool use, or treatment of another user.

A related risk is cross-user memory influence. If memory is not isolated by user, tenant, role, or workflow, content introduced through one interaction may affect another person’s future interaction. This may cause unauthorized personalization, data exposure, misleading recommendations, or actions based on context the later user never supplied.

Investigators should review memory write paths, stored memory entries, source prompts, provenance tags, identity records, retrieval logs, retention settings, isolation controls, and memory-driven outputs. Particular attention should be given to unexplained memory entries, progressively shortened or innocuous-looking records, cross-user influence, and behavior not justified by the current prompt or retrieved context.

Investigative Relevance

Persistent memory access is relevant because memory can become a durable configuration surface that shapes future synthetic subject behavior. Unlike transient prompt context, persistent memory may survive across sessions and continue influencing outputs after the original source is no longer visible.

This section is especially relevant where synthetic subjects use long-term memory, shared memory, user profiles, vector stores, task scratchpads, reusable summaries, or context stores that can be written by users, agents, tools, or retrieved content.

Long-lived agent credential occurs when a synthetic subject uses a token, secret, key, certificate, or service credential that remains valid for an extended period. This may include static Application Programming Interface (API) keys, persistent OAuth tokens, stored connector secrets, or credentials without automatic expiry.

This configuration creates an elevated exposure condition because leaked, copied, or misused credentials may remain usable long after the original deployment, workflow, or tool action. A long-lived credential can allow continued access even where the synthetic subject’s purpose has changed or the responsible owner is no longer monitoring it.

The primary risk is persistent unauthorized access. If a long-lived agent credential is exposed through logs, repositories, configuration files, browser storage, vendor tooling, or Model Context Protocol (MCP) server settings, an unauthorized party may act with the synthetic subject’s permissions until the credential is discovered and revoked.

Investigators should review token age, expiry settings, credential rotation history, vault records, access logs, connector configuration, repository exposure, and recent authentication activity. Particular attention should be given to credentials with no expiry, stale tokens, and credentials used after a deployment or integration was retired.

Investigative Relevance

Long-lived agent credentials are relevant because they extend the window in which a synthetic subject’s access can be misused. This sub-section is especially relevant where credentials grant access to customer data, production systems, mailboxes, cloud resources, or external tools.

Over-scoped agent access occurs when a synthetic subject is granted permissions beyond what is required for its approved function. This may include broad read access, write permissions, administrative scopes, cross-repository access, tenant-wide connectors, or access to data classes unrelated to the task.

This configuration creates an elevated exposure condition because any defective directive, manipulated invocation, compromised connector, or unsafe tool call may operate across a larger scope than necessary. The synthetic subject’s practical capability is defined by what its credentials allow, not by what its prompt says it should do.

The primary risk is excessive blast radius. A synthetic subject intended to summarize tickets, answer questions, or process records may be able to retrieve confidential documents, access customer data, modify systems, or transmit information outside its intended boundary.

Investigators should review assigned scopes, role grants, connector permissions, cloud roles, data access policies, tool permissions, and actual access patterns. Particular attention should be given to tenant-wide access, broad wildcard permissions, production write access, and access to sensitive repositories that are not required for the synthetic subject’s function.

Investigative Relevance

Over-scoped agent access is relevant because excessive permission turns routine AI behavior into high-impact operational risk. It is especially relevant where a low-risk assistant, embedded feature, or workflow agent has access normally reserved for privileged users or production services.

Orphaned agent identity occurs when a synthetic subject’s credential, service account, connector identity, token, or cloud role remains active after the agent, workflow, vendor tool, or integration it supported has been retired, replaced, or abandoned.

This configuration creates an elevated exposure condition because the identity may retain access without an active owner, business purpose, or monitoring expectation. Authentication by the orphaned identity may be mistaken for legacy system behavior or ignored because no current team clearly owns it.

The primary risk is uncontrolled residual access. An orphaned identity may still retrieve data, call Application Programming Interfaces (APIs), access cloud resources, or operate tools after the original synthetic subject is no longer in use. The access may be later repurposed, or become a candidate for misuse, causing validation of legitimate activity difficult, as well as attribution.

Investigators should review identity ownership, last-use timestamps, deployment records, connector inventories, access review results, vendor integrations, and decommissioning records. Particular attention should be given to active credentials linked to retired agents, inactive projects, disabled applications, former vendors, or undocumented workflows.

Investigative Relevance

Orphaned agent identities are relevant because they preserve access after operational need has ended. This sub-section is especially relevant during incident containment, vendor offboarding, platform migration, and synthetic subject decommissioning.

Uninventoried agent identity occurs when a synthetic subject authenticates through a credential, service account, token, connector, cloud role, or application identity that is not represented in asset inventory, identity governance, access review, or ownership records.

This configuration creates an elevated exposure condition because defenders may not know the identity exists, what it can access, who owns it, or which synthetic subject uses it. Without inventory coverage, the identity may fall outside monitoring, recertification, rotation, and decommissioning processes.

The primary risk is invisible authority. An uninventoried identity may continue accessing systems, retrieving data, or calling tools without being assessed as part of the organization’s synthetic subject risk surface.

Investigators should review identity provider records, cloud accounts, service principals, connector inventories, agent manifests, vendor integrations, authentication logs, and asset discovery outputs. Particular attention should be given to identities with no owner, no linked application, no documented purpose, or no access review history.

Investigative Relevance

Uninventoried agent identities are relevant because unknown identities cannot be reliably governed or contained. This sub-section is especially relevant where teams create experimental agents, vendor integrations, local automation, or Model Context Protocol (MCP) servers outside central identity processes.

Excessive agency occurs when a synthetic subject is configured with a combination of permissions, tools, functions, or action paths that exceed its approved operational purpose. This may include broad read access, write capability, administrative functions, production access, external communication authority, or permission to call high-impact tools.

This configuration creates an elevated exposure condition because the synthetic subject is not only able to access information, but also to act on it. Excessive agency may allow the synthetic subject to retrieve data, modify records, send messages, trigger workflows, call Application Programming Interfaces (APIs), change configurations, or perform operational actions beyond what its role requires.

The primary risk is excessive blast radius. A flawed directive, manipulated invocation, compromised tool, or unsafe model output may result in actions that affect systems, data, customers, or business processes outside the synthetic subject’s intended scope. This is especially significant where the synthetic subject holds standing access to privileged functions or where high-impact actions do not require separate approval.

Investigators should review the synthetic subject’s permissions, tool access, functional capabilities, connector scopes, write privileges, administrative roles, external communication authority, and approval gates. Particular attention should be given to functions that allow data modification, external transmission, production change, financial action, security control alteration, or access to backup and recovery systems.

Investigative Relevance

Excessive agency is relevant because configuration determines not only what a synthetic subject can see, but what it can do. A limited assistant may become a high-impact synthetic subject if its permissions and functions allow it to act across systems without appropriate restriction.

Delegated user account access occurs when a synthetic subject is granted access to organizational systems through a human employee’s account authorization. This may include OAuth consent, connected application approval, browser authorization, account linking, or delegated access granted through a productivity, development, or business platform.

This configuration creates an elevated exposure condition because the synthetic subject can use permissions that were originally assigned to the employee. The employee may approve the connection once, while the synthetic subject continues to retrieve data, call tools, summarize content, or perform actions within the scope of that delegated grant.

The primary risk is inherited access without equivalent oversight. A synthetic subject may access mail, documents, repositories, records, or application data through the employee’s authorization, even where the employee does not review each retrieval or action.

Investigators should review OAuth grants, connected applications, user consent records, delegated permissions, application scopes, access logs, revocation history, and vendor integrations. Particular attention should be given to broad scopes, persistent grants, third-party AI services, and delegated access that bypasses central synthetic subject governance.

Investigative Relevance

Delegated user account access is relevant because it allows a synthetic subject to operate using permissions granted to a human account. This sub-section is especially relevant where employees authorize AI tools to access mailboxes, calendars, cloud drives, source repositories, customer records, or productivity suites.

Delegated mailbox and calendar access occurs when a synthetic subject is granted permission to read, summarize, draft, send, forward, schedule, or route communications through an employee’s mailbox or calendar.

This configuration creates an elevated exposure condition because the synthetic subject can act through high-trust communication channels. It may process inbound messages, retrieve attachments, summarize threads, send replies, schedule meetings, forward information, or route calendar events using the employee’s communication context.

The primary risk is communication authority through a human identity. A synthetic subject may disclose sensitive information, send unauthorized messages, create misleading commitments, forward internal content, or schedule actions that appear to come from the employee.

Investigators should review mailbox permissions, calendar permissions, delegated access grants, OAuth scopes, sent items, forwarding behavior, calendar event history, prompt logs, and message audit records. Particular attention should be given to external recipients, sensitive attachments, unusual forwarding, automated replies, and calendar actions associated with AI tools.

Investigative Relevance

Delegated mailbox and calendar access is relevant because mail and calendar systems are trusted channels for organizational action. This sub-section is especially relevant where AI tools can send messages, forward content, schedule meetings, process attachments, or act on inbound communications through a human account.