Agent and identity governance · AgentVision360 docs

Beyond spend, AgentVision360 governs the non-human identities that use your AI — API keys, admin keys, service credentials and agents. Each one is scored, given a recommended control tier, tracked through its lifecycle, and checked for impact before anything is revoked.

Identity posture

AgentVision360 AI identities: governance posture, identities with no human owner, shadow identities, standing privilege and the identities needing governance — Governance → AI identities: every non-human identity with its accountable human, last use and findings, worst first. (Sample data.)

Every live non-human identity is scored as traceable (a real, still-employed owner and a defined scope) or shadow, and flagged for standing privilege (admin or unrestricted keys), no expiry, and whether it has recent use. You get a governance score and grade, posture by provider, and an attention list ranked worst first. Deleted and archived principals are left out — only live identities are governed.

Autonomy control tiers

Each identity gets a recommended control tier for changes to it:

Restricted — high blast radius or untraceable; changes should be tightly held.
Approval — changes should go through a second person.
Standard — low risk; normal handling.

The tier is derived from blast radius, standing privilege and traceability, so you can see at a glance which identities need the most control.

Identity lifecycle

Every identity should have a “birth certificate” — a declared owner, a defined scope, an expiry and evidence of usage. The lifecycle view shows how complete each one is and builds a worklist of identities that are idle, stale, orphaned (owner has left) or due for deprovisioning, so nothing lingers with standing access.

Find them in the Governance hub: Governance (posture and what to do next), AI identities, Keys & access, Lifecycle, Autonomy and Readiness (check a new agent’s design before it goes live).

Revocation impact

AgentVision360 Kill switch: identities with their impact if cut and what revoking does, each with Emergency revoke — Safety → Kill switch: the blast radius first (spend in 30 days, what revoking does and whether it can be undone), then an emergency revoke that still goes through approval. (Sample data.)

Before a key or seat is revoked with a kill-switch, AgentVision360 shows what it is used for — recent spend, the models and the projects behind it — so revoking it doesn’t silently break a workload. Revocation and other changes are approved actions: off by default, they run only after other people approve, and every one is recorded in the hash-chained audit trail.

Which plan

Identity posture and the governance score are included from Team. Autonomy control tiers, the lifecycle worklist, and approved actions with revocation-impact checks are on Business and above.