Non-Human Identities (NHI) with YeshID

Not every account in your tools belongs to a person. Service accounts, bots, integrations, and API credentials all log in, hold access, and act on your systems — but there's no human on the other side, and too often no one who's clearly responsible for them.

YeshID's Non-human IDs view gives you a single place to see every one of these non-human identities (NHIs) across your connected applications, understand which tools each one touches, and assign a human owner who's accountable for it.

What it gives you

• One inventory of every non-human identity: service accounts, bots, and integration credentials from all your connected apps, gathered into a single searchable list instead of scattered across each tool's admin console.

• A cross-app view of where each NHI appears: a matrix shows, for every non-human identity, which applications it shows up in, so you can spot a bot that's present in far more places than you expected.

• Shadow bots surfaced, not just managed ones: NHIs discovered in Google Workspace that aren't tied to an app you actively manage in YeshID are included, so unmanaged service accounts don't stay invisible.

• Clear accountability: assign a human Account Owner to each NHI, and see at a glance which ones are still Unowned.

• Vendor context: YeshID resolves the likely vendor behind each NHI (from the app's domain and catalog) so a cryptic account name is easier to place.

• Freshness signals: each NHI carries a last-seen time, so stale accounts that haven't been observed in a while stand out.

Key terms

What makes an identity "non-human"

Every account YeshID imports from a connected application is either human or non-human. The distinction drives how the account can be mapped:

• A non-human account cannot be mapped to a person. It stands on its own as a machine identity — but it can be given a human Account Owner who's responsible for it.

• A human account is mapped to a YeshID person and cannot have an owner (the mapped person already is the accountable human).

These two are mutually exclusive by design: an account is either a person's account or a non-human identity that a person owns. A direct mapping to a person always wins — if an account gets mapped to a person, it's treated as human and any prior non-human designation is cleared.

How NHIs are discovered

NHIs land in YeshID two ways.

Automatically, during sync. When YeshID syncs a connected application, it flags accounts that are non-human by nature. For example:

• OpenAI — project service accounts are imported as non-human identities.

• Slack — bots, app users, and Slackbot are recognized as non-human.

• Notion — bot users are marked non-human.

• GitHub — app installations are treated as non-human identities.

You don't have to tag these by hand — they arrive already classified.

Manually, when you know better than the data. From an application's Accounts table, you can designate an account as non-human yourself — useful for a service account that a tool reports as an ordinary user. Select the account (or several) and choose Mark as non-human. You can also do this while resolving unmapped accounts in Access Drift.

Assigning an Account Owner

An NHI on its own tells you what the account is; an owner tells you who to ask about it. Assigning an owner is how an anonymous bot becomes an accountable one.

From an application's Accounts table, open the account and use the identity dialog:

1. For a non-human account, the dialog opens in Assign account owner mode.

2. Select an existing person, or create a new person, to assign as the owner.

3. Save. The NHI now shows that person as its Account owner.

To remove an owner, clear the selection and save — the account stays non-human but goes back to Unowned. From the accounts table you can also select several NHIs at once and Clear owner in bulk.

Owners are only for non-human accounts. If you try to give an owner to a human account, YeshID will reject it — map the account to the person instead.

The Non-human IDs matrix

The heart of the feature is a matrix at Security → Non-human IDs. Read it like a grid:

• Each row is one non-human identity. The row shows the NHI's name, its Account owner (or Unowned), and its resolved Vendors.

• Each column is one application. The column header shows the app name and how many NHIs are present in it.

• Each cell is presence. A check means that NHI appears in that app; a dash means it doesn't. This is how you see a single service account spanning several tools at once.

Both managed identities (from your connected apps) and shadow / unmanaged bots (from Google Workspace) appear in the same grid, so nothing gets a separate, easy-to-miss list.

Reading the header totals

Above the matrix, two summary counts tell you the size of what you're looking at:

• NHIs — how many non-human identities are in the view.

• Apps — how many applications those NHIs span.

Searching

Use the search box to filter the matrix. It matches across an NHI's name, its vendor, and its owner — so you can jump to "everything owned by Dana," or "every NHI tied to Vanta," or a specific account name. Matches are highlighted, and the search is fuzzy enough to forgive partial terms.

Sorting

Click a column header to sort. You can sort by:

• Most apps / Fewest apps (the default is most apps first) — surfaces the NHIs with the widest reach.

• NHI name (A → Z or Z → A).

• Vendor (A → Z or Z → A).

• A specific app — sorting by an app column groups the NHIs that have that app ahead of the ones that lack it, and orders present ones by most recently seen.

Vendor tags

The Vendors column shows YeshID's best guess at the tool behind each NHI, drawn from the app's domain, the app catalog, and the account name. When more than one vendor is inferred, they appear as multiple tags. Vendor resolution is a hint to help you place an account — treat it as guidance, not a guarantee.

Freshness and stale accounts

Each NHI carries a last-seen time from the most recent sync that observed it. Accounts YeshID hasn't seen in a while are treated as stale — a useful cue for spotting service accounts that may have been retired at the source but still linger in an inventory or still hold access.

How it connects to other features

• Applications & accounts. NHIs are the non-human side of the same accounts YeshID imports for every connected application. Marking an account non-human and assigning its owner both happen from the application's Accounts table.

• Access Drift. When YeshID surfaces accounts that don't map cleanly to a person, you can resolve them as non-human identities right from the drift tables — so cleaning up drift also cleans up your NHI inventory.

• A person's access. The NHIs a person owns show up on that person's access graph as owned NHI relationships — so when you look at what someone has access to, the machine identities they're accountable for are part of the picture.

• RBAC and access reviews. NHIs are intentionally kept out of the human-centric checks. Access-drift signals and RBAC over-provisioning recommendations apply to people's accounts, not bots — because a service account shouldn't be flagged as "over-provisioned" against a human policy. YeshID governs NHIs through ownership instead, which is why assigning owners matters.

• Audits. Because YeshID knows which accounts are non-human and who owns them, audits can treat bot and human accounts distinctly, and an NHI's owner is the person an auditor can point to.

Tips and good habits

• Start with the widest-reaching NHIs. The default sort puts the identities present in the most apps at the top — those are usually the ones most worth having a named owner.

• Drive "Unowned" toward zero. An unowned service account is an accountability gap. Filter or scan for Unowned rows and assign someone responsible.

• Trust auto-classification, correct the exceptions. Let sync mark the obvious bots; use Mark as non-human for the service accounts a tool reports as ordinary users.

• Watch the shadow bots. Unmanaged Google Workspace bots are the ones most likely to be forgotten — they're in the matrix precisely so they don't stay invisible.

• Use last-seen as a cleanup cue. A non-human identity that hasn't been seen in a long time is a good candidate to investigate and retire at the source.