Skip to main content
Every non-human identity (NHI) - a service account, API key, bot, managed identity, or AI agent - needs an accountable owner behind it. An unowned NHI is a credential nobody is watching: nobody notices if its access grows, nobody rotates it, and nobody answers for what it did. The NHI ownership assignment workflow closes that gap by resolving ownership for every NHI Oleria discovers, through three stages: automatic detection, human review, and a time-bound fallback so nothing is left unresolved indefinitely.

​
Automatic signal detection

Oleria first looks for direct evidence of ownership from your identity provider, cloud provider, and activity history. It checks a fixed set of signals in a configurable priority order, from strongest to weakest, and stops as soon as one applies - it does not fall back to a weaker guess once a strong signal is found. Not every signal applies to every application. A cloud-specific signal, such as administering the resource hierarchy an NHI belongs to, only applies to identities from that cloud provider.
If a signal points to a disabled or long-inactive account, Oleria doesn’t assign ownership there. It looks one level up to that person’s active manager in the same system and assigns ownership there instead, when possible.
A single clear signal is enough to assign ownership - Oleria doesn’t require multiple signals to agree. When more than one signal at the same priority level points to the same person, that just reinforces the assignment.

​
Manual review when no signal is found

If none of the applicable signals identify an owner, the NHI isn’t left unassigned - it’s routed to the reviewer or reviewer group configured for that application. A reviewer can be a specific admin, a non-admin account, a role, or a user group. If more than one reviewer is assigned, the first decision made resolves the review and closes any other pending reviews for that NHI.
Oleria keeps checking for signals in the background while a review is pending. If a clear signal appears before a reviewer acts, the NHI is assigned automatically and the pending review closes on its own.

​
Fallback assignment when the review period expires

Each application has a configurable review period. If a review isn’t completed within that window, ownership is assigned automatically to a pre-configured fallback owner for that application - an admin account, a specific account, a role, or a user group, depending on how the application is configured. This assignment is recorded as a system action, distinct from a human reviewer’s decision, with the reason logged as the review period expiring without a decision. If no fallback owner is configured for an application, the NHI stays unowned rather than being assigned to an arbitrary default.

​
Summary

Oleria always tries to find a real, evidence-based owner first. If it can’t, a human reviewer gets a chance to decide. If that doesn’t happen in time, a pre-configured fallback owner steps in - so ownership never sits unresolved indefinitely, while still giving humans the first say whenever possible. See NHI ownership assignment for how to configure this workflow.

​
Contact us

For questions, contact us at support@oleria.com.