code are the values you see in the console and the API.
Connectors and synchronizations
A connector is one configured source: one AWS account, one GitHub organization, one Kubernetes cluster, one Vault, or one MCP tool server. It carries a provider, a scope (which account, organization or cluster), the capabilities it collects, and a credentials reference. It never carries credential material. A synchronization (sync run) is one collection from one connector. It records how many objects it discovered, created, updated and left unchanged, the errors it met, and whether it read the whole scope. That last fact matters: only a run that succeeded and read everything is allowed to conclude that something has disappeared. Inventory has exactly one entrance: a synchronization. There is no screen or API that creates an identity by hand. See Discovery and synchronization.Identities
An identity is one non-human identity found by a connector. Each identity has a type from a closed list:service_account, service_principal, iam_role, workload_identity, api_key, oauth_application, oauth_token, access_token, refresh_token, ssh_key, certificate, bot, automation_identity, cicd_identity, kubernetes_service_account, ai_agent, mcp_server_identity, unknown
The shipped connectors produce only iam_role, service_account, service_principal, bot, kubernetes_service_account, workload_identity and unknown (see Connectors). The other types exist in the model and no connector produces them today. When a provider will not say what something is, the type is unknown and the provider’s own type is kept beside it. NHI Security never classifies an identity from its name, and it leaves people’s accounts out of the inventory.
Evidence
Every identity records the observations behind it, each naming the connector and sync run that made it. An identity’s evidence shows those observations, including the provider’s own reference, such as an ARN.Lifecycle
Where an identity is in its life, independent of whether it is risky:
You can set only two of these by hand:
quarantined, and active to release a quarantine. Every other state is NHI Security’s reading of what the provider reported. A synchronization never moves an identity out of quarantined or decommissioned, and an identity that reappears after being decommissioned stays decommissioned. A run that failed or read only part of its scope still updates the identities it did see, but never marks anything decommissioned.
Quarantine is a state inside NHI Security. It does not disable anything at the provider. The runtime gate denies every action by a quarantined identity that asks it, and nothing else is stopped.
Ownership
An owner is a user or a team accountable for an identity. Every owner carries how it was established:
An inference never overwrites a declaration. No tag means no claim.
Credentials
A credential is how an identity authenticates, described by metadata only. NHI Security never stores or displays the secret half of a discovered credential. The model has types such asaccess_key, api_key, access_token, certificate, ssh_key, federated_trust and workload_federation; today only the AWS connector produces credentials, all of type access_key.
Each credential has a derived standing: discovered, active, expiring, expired, rotation_required, rotating, revoked or unknown. A long-lived credential is rotation_required from 90 days old, and a credential with a known expiry is expiring within 14 days of it. These two standing thresholds apply to the whole deployment. The matching policies (credential_rotation_overdue, credential_expiring) have their own thresholds, with the same defaults, that your organization can tune.
Marking a discovered credential revoked records that it should no longer be trusted. It does not revoke anything at the provider.
The identity graph
The graph joins identities, credentials, permissions, resources, teams and other nodes with typed relationships such asASSUMES, HAS_PERMISSION, BELONGS_TO, USES, ACCESSES and AUTHENTICATES_WITH.
Every edge in the graph was reported by a connector, so a path traces back to a specific connector and sync run. Each edge also records its derivation: observed when the provider stated the fact directly, or inferred when the connector applied a provider rule, such as a Kubernetes ServiceAccount annotated with the AWS IAM role it intends to assume. Nothing in the console lets a person draw an edge by hand.
Resources
A resource is something an identity can act on: a repository, an MCP server, a cloud account and so on. Of the shipped connectors, only GitHub (repositories) and MCP (the server itself) collect resources. Resources can be classified with a sensitivity (unknown, low, moderate, high, critical) and the basis for that classification. high and critical count as high impact. NHI Security never decides a resource’s importance from its name.
Policies and findings
A policy is a rule NHI Security holds your estate to, such asunowned_identity, stale_identity or credential_rotation_overdue. Each policy declares the facts it needs. When no connected environment supplies them, the policy is unavailable and names what is missing, rather than reporting zero findings.
A finding is one policy’s conclusion about one subject (an identity, credential, exposure or resource), with the facts that produced it. Its status is one of open, acknowledged, in_progress, resolved, risk_accepted or false_positive. Only an evaluation marks a finding resolved, when the condition no longer holds. See Findings and risk.