KeySkopeWhat is a non-human account?
A non-human account supports software, automation or an integration rather than an individual’s interactive work. Examples include a console account used by a scheduled job or an application identity used by a connector. Its owner should still be an accountable team or person.
The absence of a matching employee identity is not proof that an account is unwanted. It is a reason to establish purpose, ownership and access scope.
Review ownership before activity
Find the operational owner, the service the account supports and the team authorised to approve permission changes. An email address such as operations@example.com is a label, not evidence that a specific team still maintains the integration.
Ask what would fail if the account were disabled and where that dependency is documented. If nobody can answer, treat the account as unresolved and follow your escalation process rather than attempting a speculative deletion.
Use permissions and usage evidence carefully
Compare the assigned role with the operations the integration needs. A broad administrator role deserves review, but role names differ between applications. Inspect the source’s permissions before deciding that two similarly named roles have the same scope.
An interactive last-login timestamp may say little about API use. Identify the type of activity the source records. If machine activity is unavailable, do not reinterpret an empty login field as proof of non-use.
Keep credentials out of the review record
Record the credential type, owner, permissions and approved rotation process. Store references to secret locations where appropriate, never secret values in spreadsheets or screenshots. Review whether a credential is shared across environments and who can rotate or revoke it.
When the owner changes, transfer accountability and check any associated access. Rotating a credential does not automatically reduce its permissions; these are separate controls.
How KeySkope supports the investigation
Where a supported source returns a service account, KeySkope can show the collected account evidence. An orphan-account finding can help surface records without an identity match. It does not guarantee discovery of all machine identities, tokens or credentials.
Use the orphan-account workflow to establish ownership, then follow the evidence checklist to retain the reason for your decision.
Continue your review
Explore the IGA and AI access governance library, check connector coverage or read the documentation.