Concrete scenarios for security, identity, platform, and GRC teams, each mapped to a console workflow, export path, and evidence standard.
Operating model
Machine identities do not stay static. Sentyn treats governance as a closed loop: discover what exists, assign accountability, prioritize by blast radius, preview remediation impact, and prove every decision to auditors.
Connect read-only sources and sync inventory.
Install AWS IAM and GitHub connectors with least-privilege manifests. First sync surfaces service accounts, roles, keys, and OAuth apps with connector maturity labels.
OutcomeUnified NHI inventory with source, external ID, and risk tier
Open inventory surfaceResolve unknown owners with evidence.
Owner inference ranks HR, repo, IAM tag, and manual signals. Unknown and conflicted identities route to the ownership queue; manual assignment always wins.
OutcomeOwner coverage metric on dashboard; unknown-owner findings closed
Open ownership queue surfaceTriage findings by severity and scope.
Deterministic rules flag stale keys, broad policies, missing owners, and certificate risk. Eight-state lifecycle with dedupe, suppression expiry, and mandatory false-positive reasons.
OutcomeRanked finding queue with stable keys per tenant
Open findings surfaceReview remediation blast radius.
Relationship graph shows dependency paths before any provider write. Remediation preview lists affected resources and required approvals so rotation avoids surprise outages.
OutcomeBlast-radius context attached to high-risk findings
Open graph surfaceExport audit-ready evidence.
Append-only audit events capture connector changes, assignments, finding state transitions, and exports. Reports use redacted metadata only: fingerprints, never plaintext secrets.
OutcomeBoard-ready export packs with tenant-scoped audit trail
Open audit logs surfaceSurface write-capable IAM roles, long-lived access keys, and policies with `*` actions before an incident forces a fire drill. Rank by last-used signal, attached resources, and owner status.
Trigger: quarterly privileged access review or post-incident IAM scrub
Consolidate NHIs across AWS accounts and GitHub orgs into one tenant-scoped inventory. Every row shows connector source, external ID, risk tier, and owner confidence without spreadsheet reconciliation.
Trigger: org-wide visibility mandate across 10+ accounts
Before revoking a service account or rotating a deploy key, trace dependency paths through the relationship graph. See which workloads, repos, and policies break if access changes.
Trigger: credential rotation with unknown downstream impact
Route accountability for NHIs with no confirmed owner before legal, audit, or regulators ask who controls production access. Unknown-owner findings stay open until evidence-backed assignment or accepted risk.
Trigger: SOX control gap or M&A integration discovery
When HR, repo metadata, and IAM tags disagree, conflicting signals stay visible in the ownership queue and are never silently merged. Manual assignment has highest authority and cannot be overridden by inference.
Trigger: two teams claim the same CI deployer role
Run periodic ownership attestations with deadlines, evidence attachments, and audit events for every assignment change. Default 30-day attestation window; configurable per tenant.
Trigger: annual access certification program
Export inventory snapshots, open findings by severity, and append-only audit logs in one session. Evidence uses redacted fingerprints and location metadata, never raw secret values.
Trigger: board risk committee or regulatory inquiry
Demonstrate who approved each machine identity change, when connectors synced, and which findings were triaged or suppressed. Suppression requires reason and expiry; false positives require written justification.
Trigger: ITGC testing for non-human access controls
Hand procurement and security reviewers permission manifests, trust packs, and honest maturity labels before credentials are accepted. Discovery-only connectors never require provider write scopes.
Trigger: vendor security questionnaire for new SaaS
Inventory CI identities your team inherited from automation: GitHub Apps, fine-grained tokens, deploy keys, and workflow OIDC roles. Map each to repos, environments, and inferred owners.
Trigger: GitHub org audit after team reorg
Track cluster service accounts, bound roles, and token projections. Connect K8s identities to cloud IAM roles and owners so platform teams know who to page when a workload escalates.
Trigger: multi-cluster identity sprawl review
Register agent and MCP runtime identities as they enter production. Apply the same owner, finding, and audit standards as traditional service accounts with no separate shadow inventory.
Trigger: first production agent with tool-use permissions
Walk through the use case that matches your team and see the console workflow live.
