Platform & DevOps·Secrets, identity and the supply chain
the thing calling the API is not a person, and its permissions were granted once in 2022 by someone who has left.
Service account
Also calledmachine account, non-human identity
An identity belonging to software rather than a human, used for automated access. They outnumber human accounts by a wide margin, they accumulate permissions because nothing prompts a review, and they rarely have an owner. Every serious cloud compromise story features one, which is why inventorying them and attaching an expiry or a review to each is worth the tedium.