Case 001 · Priority One
An identity-security detective case. Follow the change past the config diff to the identity that made it, then contain it without breaking what depends on it.
Open the case file →Live simulation
Opening briefing · 2:44 PM UTC
At 2:31 PM, payment timeouts jumped from zero to 412 per minute. Checkout success has fallen from 99.5% to 61.4%. Traffic is normal and the payment provider reports healthy. The on-call channel says nobody has shipped anything since this morning’s release.
Behind the build
This case turns an identity-driven outage into a guided evaluation asset. The browser runs deterministic fixtures; a production implementation would read HR, directory, git, and cloud through permissioned, read-only connectors.
Live implementation
Prototype boundaries
Skills this case demonstrates
Extend the system
Case 002 is one typed fixture — evidence, timeline, suspects, remediation options, scoring keys, and its own sales playbook — running in this same shell.
Solutions Engineer mode · Case 001
In this case the departing engineer’s accounts were disabled within two hours. The AI agent they owned kept admin and deploy rights for three weeks, with no owner and no review. Rollback ends the outage; ownership and scoped access end the pattern.
DiscoverHow many non-human identities can change production today, and could you name an owner for each by end of day?
DemonstrateThe change chain with zero humans in it, and suspending one identity without breaking six pipelines.
OutcomeA defensible count of ownerless, over-privileged identities.
DiscoverWhen a service account or agent makes a production change, what evidence shows it was approved?
DemonstrateThe SoD conflict, the never-reviewed status, and the generated evidence report.
OutcomeFewer change-management exceptions and faster evidence collection.
DiscoverAre service accounts and AI agents in your certification campaigns, or only people?
DemonstrateOwner, entitlements, and review scope side by side for one agent.
OutcomeNon-human identities reviewed in the same campaigns as people.
DiscoverWhich automations sit on your branch-protection bypass lists, and who reviews that list?
DemonstrateHow a routine “optimization” reached production with no approval, and why rollback alone recurs.
OutcomeJust-in-time deploy rights that don’t slow releases.
DiscoverWhen someone leaves, does offboarding cover the systems and agents they own, or only their own accounts?
DemonstrateThe leaver that worked for the person and missed what the person created.
OutcomeOwnership transfer as a standard leaver step.
DiscoverWhat does an hour of degraded checkout cost, and what does remediating a SOX control deficiency cost?
DemonstrateRevenue at risk during the outage next to the compliance exception it created.
OutcomeA business case tying identity controls to revenue and audit cost.
Suggested path
Proof of value · 4 weeks
Two systems: one CI/CD pipeline and one production cluster. Read-only discovery first; no write actions before week 3.
Exit criterionAudit accepts the generated SoD and change-evidence report as control evidence for the pilot systems.
Objections & responses
That’s the part that worked in this case. The gap is identities people own but aren’t: service accounts, bots, and agents with no HR record to trigger removal.
Engineering creates them; audit finds them. Governance decides who owns each one, what it can touch, and for how long, without taking the pipeline away from engineering.
Scope approval to production-write actions and pre-approve routine windows. The POV measures added deploy time against a threshold your platform team sets.
Start read-only on two systems. Write actions stay with your team until the POV has met its criteria.
Evaluation criteria to leave with the buyer
Sample RFP response
Describe how the solution discovers and governs non-human identities, including AI agents, and ensures each has an accountable owner.
The solution discovers service accounts, API tokens, and AI agents through read-only connectors to cloud, SaaS, CI/CD, and directory sources, and correlates each identity to the entitlements it holds. Every non-human identity requires an accountable human owner; when an owner leaves, the HR termination event routes their identities to a successor for review within a defined SLA. Non-human identities are certified alongside people, evaluated against separation-of-duties policy, and can be suspended individually without rotating shared credentials. Every decision is logged as audit evidence.
Open questions for product
Run a 45-minute workshop with security, audit, and platform → export every non-human identity with production write access → pick two systems → agree on POV criteria → run this case as a scored tabletop with their team.
Run the case again →