Non-Human Identity Governance (NHIG) treats every service account, workload identity, API key, secret, and OAuth app as a first-class identity — with an owner, a lifecycle, and a periodic review. It’s the audit-friendly layer that sits on top of CLM, PAM, and Secrets Manager.

​
What NHIG does

  • Discovers non-human identities across AWS, Azure, GCP, Kubernetes, on-host services, and application connectors.
  • Builds an ownership graph — who is accountable for each identity, what it can access, how recently it was used.
  • Detects findings: orphaned identities, stale identities (no use in N days), over-privileged roles, missing rotation, unowned secrets.
  • Runs access review campaigns — periodic sign-off cycles for every identity or scope.
  • Exports attestation reports for auditors and compliance owners (SOC 2, ISO 27001, PCI-DSS).

​
Architecture

DISCOVERY SOURCES            NHIG ENGINE                      REVIEWERS
┌────────────────┐    read   ┌───────────────────┐    UI     ┌──────────┐
│ AWS / Azure /  │──────────►│   Identity        │◄──────────│ Owner    │
│ GCP roles      │           │   inventory       │           │          │
├────────────────┤           │                   │           │          │
│ Kubernetes RBAC│──────────►│   Ownership graph │◄──────────│ Approver │
├────────────────┤           │                   │           │          │
│ On-host agent  │──────────►│   Findings engine │           │          │
├────────────────┤           │                   │    export │          │
│ App connectors │──────────►│   Review campaigns│──────────►│ Auditor  │
└────────────────┘           └───────────────────┘   evidence└──────────┘

Install NHI Governance

Read-only cloud roles plus (optional) on-host discovery agent.

​
Core concepts

Identities

Every discovered non-human identity — kind, source, last-used, permissions, owner.

Ownership

Who is accountable for each identity, delegation rules, and attestation history.

Findings

Orphaned, stale, over-privileged, unowned, unrotated — with remediation actions.

Access reviews

Campaign-driven periodic sign-off with named reviewers and evidence trail.

​
What gets classified as an identity

SourceKinds
AWSIAM users, roles, access keys, KMS keys, Secrets Manager secrets, SSM parameters, ECS/EKS/Lambda execution roles
AzureService principals, managed identities, application registrations, Key Vault objects
GCPService accounts, service-account keys, workload-identity bindings
KubernetesServiceAccounts, ClusterRoleBindings, RoleBindings, pod-referenced secrets
On-hostLocal service accounts, systemd unit users, cron owners, kubeconfig subjects
ApplicationsGitHub Apps, OAuth clients, DB service accounts, MQ users
TigerTrust modulesCLM certificates + private keys, PAM machine bots, SM AppRoles / tokens

​
How NHIG interacts with other modules

  • CLM contributes every discovered certificate as an identity (owner attribution, rotation state).
  • PAM contributes every issued machine credential and long-lived role binding.
  • SM contributes every AppRole, JWT audience, and token issued.
The single inventory means one review campaign covers every credential type — no more spreadsheets stitching things together.

​
Where to start

Install and connect a cloud

Read-only role → first inventory sweep in under 15 minutes.

Assign owners

Bulk-assign owners to every identity that landed in the inventory.

Your first review campaign

Scope + reviewers + due date. Evidence auto-collected.

Fix the top findings

Orphaned and stale identities usually dominate the first scan.