Orphaned Account Checker

11. AI agent credential with no owner or no review

An AI agent reaches data and starts work through its credential; an agent credential with no owner, or one nobody has reviewed, acts outside anyone's account of who can do what.

The rule it applies

An AI agent credential with no owner, a team for an owner, an owner who has left, no review recorded, or a review older than the interval. Without a review column, the review half is a question.

A question for the account owner

Which person owns this agent's credential, and what can it reach?

Clauses

5 across the regimes you tick
RegimeClauseRead on
ISO/IEC 27001ISO/IEC 27001 A.5.16 Identity managementevery account type
ISO/IEC 42001ISO/IEC 42001 clause 5.3 Roles, responsibilities and authoritiesevery account type
ISO/IEC 42001ISO/IEC 42001 A.3.2 AI roles and responsibilitiesevery account type
SOC 2SOC 2 CC6.1 Logical access security over protected information assetsevery account type
CIS ControlsCIS Controls 5.5 Establish and Maintain an Inventory of Service Accountsevery account type

The first clause, set out

ISO/IEC 27001 A.5.16Identity management

Identities are to be managed throughout their whole life cycle. Purpose (stated in ISO/IEC 27002:2022): enables unique identification of people and systems accessing organizational assets and appropriate assignment of access rights. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 5.16.

What an auditor asks to see: Statement of Applicability entry for control A.5.16, showing inclusion or justified exclusion, implementation status and the risks it treats; Identity management procedure covering creation, verification, activation, change, disablement and removal; Evidence that identities are verified against trusted documents before issue; A register of shared identities with the business justification and approval for each; A register of non-human identities (service accounts, machine identities) with segregated approval and an independent oversight record
Where account lists usually fall short: Generic shared accounts exist without documented justification or approval; Service accounts have no owner and no periodic oversight; Identities of leavers remain enabled for weeks because HR notifications are not integrated; The same person holds several identities in one directory, undermining accountability
Source: ISO/IEC 27001:2022 Annex A

See it on the specimenAll fourteen findings