How the gate works

How the Non-Human Identity & Credential Sprawl gate works

This tool grades one class of machine identities - CI/CD keys, service accounts, deploy tokens. Each signal is scored 0–1; the verdict is the weakest one — then a gate that can only make it worse.

The 6 signals

01Inventory / discovery of every machine identity

02Each identity has a named human owner

03Least-privilege scope (not broad / admin)

04Rotation & expiry (credentials are not eternal)

05Secrets vaulted, not hardcoded in repos / configtop trigger

06A working revocation / offboarding pathtop trigger

GOVERNED

every control Governed (2)

SPRAWLING

weakest control = Partial (1)

UNMANAGED

any control at Open (0) - or storage and revocation both below Governed

Leaked-key gate · worsen-only

If secrets aren't vaulted AND there's no working revocation path, a leaked credential is both reachable and un-killable - UNMANAGED regardless of the weakest-control score. Bring either storage or revocation to Governed and it releases.

UNMANAGED

Why: Inventory, ownership, scope, and rotation are all Governed - but secrets storage and the revocation path are only Partial, so a leaked credential here is both reachable and can't be killed. The gate forces UNMANAGED regardless of the 83% mean. weakest signal 1/1 · 4 of 6 controls Governed, mean 83/100.

Fix firstVault secrets (stop hardcoding) - move hardcoded credentials into a vault first; wiring a revocation path releases the gate too.

A clean sheet didn’t save it. The verdict is the weakest signal — and a top trigger is dispositive on its own — so it names the one thing to fix first. Grades the setup, never people. Not a secret scanner or vault. Runs offline in the workbook and engine.

RedHub AIthe AI that tells you when to doubt it redhub.ai/systems/non-human-identity-credential-sprawl-gate