Non-Human Identity Governance Lab

LAB / REFERENCE IMPLEMENTATION: This experimental project explores governance patterns for service accounts, app registrations, managed identities, and AI-agent identities. It is not a claim of deployed enterprise AI-agent IAM experience or production use.

What this demonstrates

• A small JSON inventory model for identity type, owners, scopes/roles, approvals, review, expiration, and credential rotation metadata
• Policy checks for ownership, accountable human review, least privilege, expiry, rotation, environment separation, and high-impact access
• Deterministic JSON and Markdown reports suitable for local review or CI
• Append-only local audit events without live identity-provider mutation
• Fictional sample records using reserved example domains and non-routable identifiers

The lab does not authenticate to a tenant, provision identities, rotate credentials, or enforce access. It turns reference policy into transparent, testable checks.

Quick start

Python 3.10+; no third-party packages are required.

python3 -m src.governance validate --inventory data/identities.json --policy data/policy.json
python3 -m src.governance report --inventory data/identities.json --policy data/policy.json --output governance-report.md
python3 -m unittest discover -s tests -v

Validation returns exit code 0 when no error-severity finding exists and 1 otherwise. The fictional samples intentionally include a record that needs review so the report demonstrates both passing and failing controls.

Reference lifecycle

Requested -> Approved -> Provisioned -> Active -> Review due -> Rotated or remediated -> Retired

Every identity should have a purpose, environment, system owner, accountable human owners, approved scopes, review cadence, and retirement trigger. Credential-bearing identities additionally need rotation metadata; platform-managed identities explicitly declare that the platform owns credential rotation.

Files

• data/schema.json — inventory JSON Schema
• data/policy.json — reference thresholds and restricted permissions
• data/identities.json — fictional sample inventory
• src/governance.py — policy validator, report generator, and audit writer
• docs/THREAT_MODEL.md — threats, controls, assumptions, and residual risk
• tests/ — standard-library unit tests

Read ARCHITECTURE.md and SECURITY.md before adapting the model.

License

MIT. See LICENSE.