Ownership & category model
HRIS governs humans. Every non-human identity is owned by a human and tied to the
service it delivers. Three relationships the org chart wrongly collapses into one pointer: manager
(super_ref, people only), owner (accountable human, for every NHI), and delivers
(the service). Agents add a fourth — on-behalf-of a human sponsor.
The classes
| Class | Example | System of record | Owner | Org-chart node | Ties to | Lifecycle trigger |
|---|---|---|---|---|---|---|
| Human worker | gary.townsend | HRIS-Lite | self | yes (super_ref) | — | employment |
| Elevated | t0/t1/t2-gtown.adm | linked to human (IGA/PAM) | the human | no — linked | parent human + tier | cascades from human |
| Break-glass | break-glass-lab.adm | IGA/PAM | role + sponsor | no | protected role | dormant · audited |
| Service account | svc-duoauthproxy | NHI registry (taxonomy.psd1) | human owner + backup | no | Service (CMDB) + CIs | the service, not the owner |
| Service principal | MSOL_… | NHI registry | integration owner | no | integration / app CI | the integration |
| Agent / agentic | automation · claude-code | NHI registry (Duo agent) | on-behalf-of human | no | human sponsor + service + scope | the human (re-own/retire) |
Topology
Where it doesn't live
Non-human identities are not Workers. HRIS's population is people; the NHI registry
(taxonomy.psd1) holds service accounts, principals, and agents, each carrying a pointer to its
accountable human owner. This is the same split Cisco Identity Intelligence is becoming — Oort
for humans, Astrix for non-human — with BloodHound Enterprise adding the
attack-path view (which owned identities are a path to your T0 tier / Tier Zero). More on the
agentic AI page.
And where does the secret live? Not with the identity. The NHI registry governs the service account; its credential is vaulted in 1Password — humans check out break-glass the CyberArk PVWA way, machines fetch their own secret via 1Password Connect the CCP way. Identity and secret are governed together, stored apart — see the architecture page.