01
02 · See · Machines need owners too
Non-human identities
Govern service accounts, bots and agents based on why they exist.
Each service account, bot and agent gets an owner, a reason that decides how long it lives, a view of what it can reach and a review schedule. A machine identity without an owner becomes a task for someone.
What changes
What you get
02
An owner and a reason for each one
03
What each one can reach
04
Reviews that match what it can do
How it works
It works in three steps
Each step records its reason, and the next step uses it.
Classify
Separate what the identity is from why it exists.
Assign
Give it a human owner and a reason that decides how long it lives.
Attest
Review on a schedule that matches autonomy and reach.
The chain view
From the person who answers for a machine identity to the applications it reaches, in one view
Every non-human identity has a Chain tab, and an AI agent shows the same chain as a strip under its name. It reads in order:
Owner
Who answers for it, and whether that came from an assignment, an ownership rule or the Entra sponsor.
Acts for
The person or team it is declared to act for.
Credentials
The secrets and keys it can sign in with, and their dates.
Tools
The tools it reaches through RapidValue.
Recorded actions
What RapidValue recorded it doing.
Applications
The applications where it holds access.
Each link says whether it is verified, declared or unknown, why it is unknown and how fresh it is. The same chain is a section of the AI-agent evidence pack. Generated for one agent, that pack is the agent’s EU AI Act pack, with an article map that says what it shows and what it does not. The chain shows what RapidValue can see. Tool calls that do not pass through RapidValue are not in it.
Credential inventory
Every machine secret has an age, an expiry date and an owner, and if one is missing you get a finding
RapidValue records credential metadata from the systems that issue them. Secret values never enter the platform.
What becomes a finding
- A credential that never expires
- A credential that expires within 30 days
- An API credential that is no longer used
- A working credential older than 90 days, so its rotation is overdue
Microsoft Entra IDApp-registration secrets and certificates
AWS IAMAccess keys and when they were last used
Google CloudUser-managed service-account keys
Google WorkspaceApp passwords
SalesforceOAuth tokens of agent and integration users
ServiceNowRefresh tokens, API keys and OAuth registrations of integration users
Active DirectoryPassword age as rotation, last logon as use
RapidValueAPI credentials the platform issued itself
Ownership that survives change
When an owner leaves, the machine identity should not be left without one
01
Orphan inbox
Identities without an owner arrive as a task, with a suggested owner.
02
Claim flow
A proposed owner accepts, redirects, escalates or rejects. Claims that get no answer expire.
03
Groups and delegates
A team can own an identity, with a primary owner and time-bound substitutes.
04
Retire with a record
Retiring an identity revokes its grants, disables its accounts and keeps the record for the audit trail.
What we stand behind
A machine account without an owner stays on the list of gaps until someone takes it.
Included
Included in every price
There is no module to buy for this. The price depends only on how many identities you govern.
Non-human identities