Ownership & category model
Topology
HRIS governs humans. Every non-human identity is owned by a human and tied to the
service it delivers. Three relationships the org chart wrongly collapses into one pointer: manager
(super_ref, people only), owner (accountable human, for every NHI), and delivers
(the service). Agents add a fourth — on-behalf-of a human sponsor.
The classes
| Class | Example | System of record | Owner | Org-chart node | Ties to | Lifecycle trigger |
|---|---|---|---|---|---|---|
| Human worker | a worker | HRIS | self | yes (super_ref) | — | employment |
| Elevated | t0/t1/t2 admin | linked to human (IGA/PAM) | the human | no — linked | parent human + tier | cascades from human |
| Break-glass | break-glass admin | IGA/PAM | role + sponsor | no | protected role | dormant · audited |
| Service account | a service account | NHI registry | human owner + backup | no | Service (CMDB) + CIs | the service, not the owner |
| Service principal | a sync principal | NHI registry | integration owner | no | integration / app CI | the integration |
| Agent / agentic | automation · claude-code | NHI registry (Duo agent) | on-behalf-of human | no | human sponsor + service + scope | the human (re-own/retire) |
Where it doesn't live
Non-human identities are not Workers. HRIS's population is people; the NHI registry holds service accounts, principals, and agents, each carrying a pointer to its accountable human owner. This is the same split Cisco Identity Intelligence is becoming — Oort for humans, Astrix for non-human — with BloodHound Enterprise adding the attack-path view (which owned identities are a path to your T0 tier / Tier Zero). More on the agentic AI page.
And where does the secret live? Not with the identity. The NHI registry governs the service account; its credential is vaulted in a secrets vault — humans check out break-glass the CyberArk PVWA way, machines fetch their own secret via the vault Connect API the CCP way. Identity and secret are governed together, stored apart — see the architecture page.