Everyone reviews the identities they can see

Everyone reviews the identities they can see. Nobody asks about the ones they can’t.

Human identities get monthly audits, named owners and expiry cycles. Machine identities (service accounts, API keys, bot tokens, CI/CD credentials) get created, assigned broad permissions and forgotten.

The attack surface nobody is governing isn’t new. It’s been there since the last project went live.