> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# How Oleria assigns NHI ownership

> How Oleria decides who owns a non-human identity (NHI) - the evidence it looks for automatically, when a human reviewer gets involved, and what happens if nobody acts in time.

Every non-human identity (NHI) - a service account, API key, bot, managed identity, or AI agent - needs an accountable owner behind it. An unowned NHI is a credential nobody is watching: nobody notices if its access grows, nobody rotates it, and nobody answers for what it did. The **NHI ownership assignment** workflow closes that gap by resolving ownership for every NHI Oleria discovers, through three stages: automatic detection, human review, and a time-bound fallback so nothing is left unresolved indefinitely.

## Automatic signal detection

Oleria first looks for direct evidence of ownership from your identity provider, cloud provider, and activity history. It checks a fixed set of signals in a configurable priority order, from strongest to weakest, and stops as soon as one applies - it does not fall back to a weaker guess once a strong signal is found.

| Signal                                 | What it means                                                                                                               |
| :------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------- |
| Owner assigned by source system        | Your identity provider or cloud provider already records an explicit owner for this identity.                               |
| Created by this user                   | The identity's creation event shows who created it.                                                                         |
| Manages its group or role              | A user administers the group or role the NHI belongs to.                                                                    |
| Can act as this user                   | A user holds impersonation or delegation rights over the NHI - for example, they can assume its role or authenticate as it. |
| Application or instance administration | A user administers the specific application, managed identity platform, or AI agent platform the NHI runs on.               |
| Matching name                          | The NHI's name closely matches a known user or team naming convention.                                                      |

Not every signal applies to every application. A cloud-specific signal, such as administering the resource hierarchy an NHI belongs to, only applies to identities from that cloud provider.

<Note>
  If a signal points to a disabled or long-inactive account, Oleria doesn't assign ownership there. It looks one level up to that person's active manager in the same system and assigns ownership there instead, when possible.
</Note>

A single clear signal is enough to assign ownership - Oleria doesn't require multiple signals to agree. When more than one signal at the same priority level points to the same person, that just reinforces the assignment.

## Manual review when no signal is found

If none of the applicable signals identify an owner, the NHI isn't left unassigned - it's routed to the reviewer or reviewer group configured for that application. A reviewer can be a specific admin, a non-admin account, a role, or a user group.

If more than one reviewer is assigned, the first decision made resolves the review and closes any other pending reviews for that NHI.

<Note>
  Oleria keeps checking for signals in the background while a review is pending. If a clear signal appears before a reviewer acts, the NHI is assigned automatically and the pending review closes on its own.
</Note>

## Fallback assignment when the review period expires

Each application has a configurable review period. If a review isn't completed within that window, ownership is assigned automatically to a pre-configured fallback owner for that application - an admin account, a specific account, a role, or a user group, depending on how the application is configured.

This assignment is recorded as a system action, distinct from a human reviewer's decision, with the reason logged as the review period expiring without a decision. If no fallback owner is configured for an application, the NHI stays unowned rather than being assigned to an arbitrary default.

## Summary

Oleria always tries to find a real, evidence-based owner first. If it can't, a human reviewer gets a chance to decide. If that doesn't happen in time, a pre-configured fallback owner steps in - so ownership never sits unresolved indefinitely, while still giving humans the first say whenever possible.

See [NHI ownership assignment](/posture/nhi-ownership-assignment-workflow) for how to configure this workflow.

## Contact us

For questions, contact us at [support@oleria.com](mailto:support@oleria.com).