Service Accounts

Service accounts, deployment identities, API tokens, and other non-human identities must follow the Access Control Policy.

1. Ownership and Purpose

Each non-human identity must have a defined business purpose and an accountable owner. Shared or non-personal accounts must also document their purpose, owner, authorized users, and credential-management arrangements.

2. Permissions and Credentials

Permissions must be restricted to the operations the identity needs to perform.

Where supported, credentials must be stored in an approved secrets-management system and rotated according to the applicable security requirements. Secrets must not be stored in the Access Management Register or ordinary documentation.

3. Review and Lifecycle

Non-human identities must not be treated as ordinary employee accounts or omitted from access reviews.

The responsible owner must validate quarterly that each identity remains necessary, that its permissions are appropriate, and that unused credentials or identities are disabled or removed. Record the review and any resulting remediation according to the Access Reviews procedure.