The Accounts Nobody Hired

Joining, moving, and leaving all follow people. Nonhuman accounts do none of that. Nobody hires a service account. It never changes jobs. It never has a last day. It just keeps running.

At one organization, a directory cleanup meant going through every nonhuman account to figure out what access each one actually needed.

We started with the accounts that held the highest-risk access. That was the right call. It still took several months.

The access varied widely. Some accounts had very little. Others had far more than anyone could explain. Every one had to be looked at on its own.

Figuring out who owned each account was often harder than figuring out what it could do. The person who created it had moved on, or the team that relied on it had changed. An account with no owner is an account nobody can make a decision about.

And many of those accounts belonged to vendor products. That meant going back to the vendor, asking exactly what their product needed, and working toward an answer specific enough to scope.

This is what happens when accounts are created to solve a problem in the moment and never given an owner, a purpose, or an end.

Here is how I would lead it again.

Start with the highest-risk access, and tell leadership up front that it will take months.

Treat ownership as the first deliverable. Until someone owns an account, nobody can make a real decision about its access.

Bring vendors in early, and make "what exactly does your product need" part of how you buy and renew.

And stop the next backlog from forming. Every new nonhuman account gets a named owner, a stated purpose, and scoped access the day it is created.

This was before AI agents started showing up in the same directories. That part gets its own post.

Related

• Series 1 Post 5: LinkedIn post
• Series 2 Post 13: LinkedIn post
• Series 3 Post 3, The Cost of Access That Never Leaves