Tool Gate · How it works
How the Non-Human Identity & Credential Sprawl Gate gate works
How the Non-Human Identity & Credential Sprawl Gate scores 6 machine-identity controls by the weakest signal: a leaked-key gate forces UNMANAGED when secrets storage and the revocation path are both only partial — which is how 4 of 6 controls read governed, the mean reads 83%, and it still reads UNMANAGED.
How the gate works
This tool grades one class of machine identities - CI/CD keys, service accounts, deploy tokens. Each of 6 signals is scored 0–1 from your own evidence; the verdict is the weakest one — and then it is run past a gate that can only make the verdict worse.
The 6 signals
| Signal | Role |
|---|---|
| Inventory / discovery of every machine identity | signal |
| Each identity has a named human owner | signal |
| Least-privilege scope (not broad / admin) | signal |
| Rotation & expiry (credentials are not eternal) | signal |
| Secrets vaulted, not hardcoded in repos / config | top trigger |
| A working revocation / offboarding path | top trigger |
The verdict bands
If secrets aren't vaulted AND there's no working revocation path, a leaked credential is both reachable and un-killable - UNMANAGED regardless of the weakest-control score. Bring either storage or revocation to Governed and it releases.
In the worked sample 4 of 6 controls Governed, mean 83/100 (weakest 1) and it still reads UNMANAGED — Inventory, ownership, scope, and rotation are all Governed - but secrets storage and the revocation path are only Partial, so a leaked credential here is both reachable and can't be killed. The gate forces UNMANAGED regardless of the 83% mean. The one thing to fix first: Vault secrets (stop hardcoding) - move hardcoded credentials into a vault first; wiring a revocation path releases the gate too..
Common questions
Can a profile look clean on the How the Non-Human Identity & Credential Sprawl gate works and still fail?
Yes. The verdict is the weakest of 6 signals, then run past a worsen-only gate — the Leaked-key gate — that can only make it worse. In the worked sample 4 of 6 controls Governed, mean 83/100 (weakest 1) and it still reads UNMANAGED, because inventory, ownership, scope, and rotation are all Governed - but secrets storage and the revocation path are only Partial, so a leaked credential here is both reachable and can't be killed. The gate forces UNMANAGED regardless of the 83% mean.
What is a worsen-only gate?
A dispositive rule that can only lower a verdict, never raise it. One fatal flaw overrides an otherwise-clean sheet, because a single disqualifying gap shouldn't hide behind everything that passed. The tool also names the one thing to fix first — here, "Vault secrets (stop hardcoding) - move hardcoded credentials into a vault first; wiring a revocation path releases the gate too.".
Grades the setup, never people. Not a secret scanner or vault. Runs offline in the workbook and engine.
Embed this diagram
Free to share and embed with attribution (CC BY 4.0) — keep the link to redhub.ai.
Interactive — renders the live diagram
<iframe src="https://redhub.ai/visuals/tool/non-human-identity-credential-sprawl-gate.html" title="How the Non-Human Identity & Credential Sprawl Gate gate works — RedHub AI" width="760" height="1725" loading="lazy" style="border:0;width:100%;max-width:760px"></iframe>
<p style="font:14px/1.5 system-ui,sans-serif"><a href="https://redhub.ai/visuals/tool/non-human-identity-credential-sprawl-gate">How the Non-Human Identity & Credential Sprawl Gate gate works</a> — by <a href="https://redhub.ai">RedHub AI</a>, the AI that tells you when to doubt it.</p>Image + link — a static picture for any blog
<a href="https://redhub.ai/visuals/tool/non-human-identity-credential-sprawl-gate"><img src="https://redhub.ai/visuals/tool/non-human-identity-credential-sprawl-gate-share.png" alt="Diagram of the Non-Human Identity & Credential Sprawl Gate: six machine-identity controls scored by the weakest signal and a leaked-key gate forcing UNMANAGED despite an 83% mean." width="760" loading="lazy" style="max-width:100%;height:auto;border-radius:16px"></a>
<p style="font:14px/1.5 system-ui,sans-serif"><a href="https://redhub.ai">RedHub AI</a> — the AI that tells you when to doubt it.</p>
This is how Non-Human Identity & Credential Sprawl Gate works. More diagrams in the Visual Field Guide.