Every identity in NHIG has (or needs) an owner — a human accountable for its existence, permissions, and lifecycle. Unowned identities dominate first-scan findings and block audits.

​
Assign in bulk

The fastest way to get to zero-unowned is to bulk-assign:
  • By label match: system=payments → assign to the payments-team owner.
  • By naming pattern: arn:aws:iam::*:role/lambda-* → assign to the platform team.
  • By source account: everything in AWS account 123456789012 → assign to the account owner.
NHIG → Inventory → Bulk Actions → Assign Owner → Rule builds these rules interactively.

​
Delegation

Owners can nominate a delegate for a bounded window (vacation, incident response): 
tt nhig delegate create --owner=alice@example.com --delegate=bob@example.com --until=2026-10-01
During the window, review campaigns route to Bob. The audit row still records Alice as owner-of-record.

​
Attestation

An owner attests an identity by acknowledging in the UI or CLI that the identity is legitimate and the permissions are appropriate: 
tt nhig attest nhi_xxx --reason="reviewed for Q3 2026"
Attestations are timestamped and signed by the reviewer’s session token. The next review campaign’s SLA runs from the attestation date.

​
Ownership graph

NHIG → Graph renders the identity → owner relationships as a searchable graph — useful for spotting single points of failure (one engineer owning 400 identities) or org-chart drift (identities owned by ex-employees still active in HR).

Access reviews

Campaigns force periodic re-attestation.

Findings

Unowned identities are always flagged.