Identity and Access Management

Separate Human and Service Identities

A developer needs a background job to read from an internal API. The fastest solution may be to reuse the developer’s own account, save its credential in the job, and move on. That shortcut quietly joins two different security problems. A human account is designed around a person’s login, employment, recovery, and interactive authentication. A service identity is used by software that runs without a person present. When one identity is forced to serve both roles, permissions become harder to limit, credentials are harder to rotate, and logs can no longer clearly tell whether an action came from a person or an automated workload.