01 / The operating case
What changes in a real workflow?
A finance bot survives its original team and keeps a production service account.
- 01Owner
- 02Agent + workload
- 03Task context
- 04Action decision
02 / Decision boundary
Put the check where it can stop the effect.
Inventory the principal, owner, workload, credential and grants; review use and terminate unused access after transfer.
03 / Failure and evidence
What goes wrong, and what can be proven?
Failure mode
An orphaned service identity remains valid although no accountable owner accepts it.
Evidence to retain
Keep lifecycle events, ownership attestations, token use and access removal.
04 / Canonical scope
Why this reference stands alone
The lifecycle page owns transitions; this page owns the broader NHI governance inventory.
Technical artifact
Join principal, owner and observed access
principal: svc-invoice-7 owner: finance-platform (attested 2026-08-01) workload: invoice-agent production observed API use: payment.release on 2026-09-14 registered grant: invoice.read only → investigate mismatch
Run the denial test
Remove the owning team while leaving the service credential valid. Flag the identity for suspension and prove a subsequent payment attempt fails.
Primary references