Attestation Campaigns

Attestation campaigns are structured access reviews that require designated reviewers to certify that non-human identities have appropriate access. Regulatory frameworks including SOC 2, HIPAA, and PCI-DSS require periodic access reviews, and VeraID automates the process — from campaign creation through reviewer assignment, decision tracking, and evidence collection.

Why Attestation

Over time, non-human identities accumulate access that exceeds their operational needs. Service accounts retain permissions from projects that ended months ago. AI agents keep scopes that were granted for a one-time task. CI/CD tokens hold production access that was only needed during a migration. Attestation campaigns force a systematic review of these permissions, ensuring that every identity holds only the access it currently requires.

Key outcomes:

• Least privilege enforcement — Reviewers identify and remove excessive permissions
• Compliance evidence — Signed attestation records serve as audit evidence for SOC 2, HIPAA, and PCI-DSS
• Stale identity discovery — Campaigns surface identities that are no longer in use and should be decommissioned
• Accountability — Every access decision is attributed to a named reviewer with a timestamp and justification

---

Campaign Lifecycle

Every attestation campaign follows a defined lifecycle with four terminal states.

┌──────────┐    launch      ┌──────────┐    all reviewed    ┌────────────┐
│  DRAFT   │───────────────►│  ACTIVE  │──────────────────►│ COMPLETED  │
│          │                │          │                    │            │
└──────────┘                └────┬─────┘                    └────────────┘
                                 │
                                 │  cancel
                                 ▼
                            ┌────────────┐
                            │ CANCELLED  │
                            └────────────┘

Status	Description
DRAFT	Campaign is being configured. Scope, reviewers, and deadlines are set but no review tasks are created.
ACTIVE	Campaign is live. Review tasks are assigned to reviewers, and notifications are sent.
COMPLETED	All review tasks have been decided (approved, rejected, or escalated). The campaign record is immutable.
CANCELLED	Campaign was cancelled before all reviews were completed. Partial results are retained.

Create a Campaign

curl -X POST https://app.veraid.io/api/v1/attestation/campaigns \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Q1 2026 NHI Access Review",
    "description": "Quarterly review of all production non-human identity access",
    "status": "DRAFT",
    "scope": {
      "identityTypes": ["SERVICE_ACCOUNT", "API_KEY", "AI_AGENT"],
      "riskLevels": ["HIGH", "CRITICAL"],
      "tags": ["production"],
      "environments": ["production", "staging"]
    },
    "deadline": "2026-04-15T23:59:59Z",
    "reminderSchedule": {
      "firstReminder": "2026-04-08T09:00:00Z",
      "frequency": "daily",
      "escalateAfter": "2026-04-13T09:00:00Z"
    },
    "requireJustification": true,
    "requireSignature": true
  }'

---

Campaign Scope

The scope determines which identities are included in the attestation campaign. Scope filters can be combined to target specific subsets of your identity inventory.

Filter	Type	Description
identityTypes	string[]	Include only these NHI types (e.g., SERVICE_ACCOUNT, AI_AGENT)
riskLevels	string[]	Include identities at these risk levels: LOW, MEDIUM, HIGH, CRITICAL
tags	string[]	Include identities with any of these tags
environments	string[]	Include identities associated with these environments
owners	string[]	Include identities owned by these users or teams
lastUsedBefore	datetime	Include identities not used since this date (for stale identity discovery)
excludeIdentities	string[]	Explicitly exclude specific identity IDs

Tip

Run separate campaigns for different risk levels. High-risk and critical identities should be reviewed quarterly, while low-risk identities can be reviewed semi-annually. This reduces reviewer fatigue and focuses attention where it matters most.

Scope Example: Stale Identity Discovery

Target identities that have not been used in 90 days for decommissioning review:

{
  "scope": {
    "lastUsedBefore": "2025-12-19T00:00:00Z",
    "identityTypes": ["SERVICE_ACCOUNT", "API_KEY", "OAUTH_TOKEN"],
    "tags": ["production"]
  }
}

---

Reviewer Workflows

When a campaign is launched, VeraID generates a review task for each in-scope identity and assigns it to the appropriate reviewer. Reviewers evaluate each identity’s current access and render a decision.

Review Decisions

Decision	Description
PENDING	Review task is assigned but the reviewer has not yet made a decision
APPROVED	Reviewer certifies that the identity’s current access is appropriate
REJECTED	Reviewer determines that the identity’s access should be modified or revoked
ESCALATED	Reviewer cannot make a determination and escalates to a higher authority

Review Task Structure

{
  "id": "rev_1a2b3c4d-5e6f-7a8b-9c0d-e1f2a3b4c5d6",
  "campaignId": "camp_9f8e7d6c-5b4a-3c2d-1e0f-a9b8c7d6e5f4",
  "identityId": "idt_9c3a8b7e-4f21-4d6a-b8e1-a2c5d9f07e3b",
  "identityName": "payment-processor",
  "identityType": "SERVICE_ACCOUNT",
  "reviewer": "user:alice@example.com",
  "status": "PENDING",
  "currentAccess": {
    "scopes": ["read:transactions", "write:refunds", "admin:billing"],
    "resources": ["prod:payment-gateway", "prod:billing-db"],
    "credentials": 3,
    "policies": 2
  },
  "riskScore": 67,
  "lastUsedAt": "2026-03-18T22:15:44Z",
  "deadline": "2026-04-15T23:59:59Z",
  "assignedAt": "2026-03-19T09:00:00Z"
}

Submit a Review Decision

curl -X POST https://app.veraid.io/api/v1/attestation/reviews/{reviewId}/decide \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "decision": "REJECTED",
    "justification": "The admin:billing scope is excessive for this service account. It only processes refunds and should have write:refunds and read:transactions only.",
    "recommendedActions": [
      {
        "action": "remove_scope",
        "scope": "admin:billing",
        "reason": "Principle of least privilege - admin access not required for refund processing"
      }
    ]
  }'

Note

When requireJustification is enabled on the campaign, reviewers must provide a written justification for every decision — including approvals. This creates a complete decision trail for compliance auditors.

---

Review Deadlines

Every campaign has a deadline by which all reviews must be completed. VeraID enforces deadlines through automated reminders and escalation.

Reminder Schedule

Field	Description
firstReminder	Date to send the first reminder to reviewers with outstanding tasks
frequency	Reminder frequency: daily, weekly, or custom interval
escalateAfter	Date after which unresolved reviews are escalated to the reviewer’s manager

Escalation Behavior

When a review is escalated:

1. The original reviewer is notified that their review has been escalated
2. The escalation target (typically the reviewer’s manager) receives the review task
3. The escalation is logged in the campaign audit trail
4. If the escalation target also does not respond by the deadline, the campaign owner is notified

{
  "escalation": {
    "escalateAfter": "2026-04-13T09:00:00Z",
    "escalateTo": "manager",
    "finalAction": "flag_for_campaign_owner",
    "notifyChannels": ["email", "slack"]
  }
}

---

Signature Tracking

For regulated environments, VeraID supports digital signature tracking on attestation decisions. When requireSignature is enabled, reviewers must cryptographically sign their decisions using their VeraID identity.

Signature Record

{
  "signature": {
    "reviewer": "user:alice@example.com",
    "decision": "APPROVED",
    "signedAt": "2026-03-20T10:15:00Z",
    "signatureHash": "sha256:a1b2c3d4e5f6...",
    "justification": "Access reviewed and confirmed appropriate for current operational requirements",
    "ipAddress": "10.0.1.42",
    "userAgent": "VeraID Dashboard/2.1.0"
  }
}

Signature records are immutable and stored alongside the review decision in the audit log. They serve as tamper-evident proof that a specific reviewer made a specific decision at a specific time.

Caution

Once a review is signed, the decision cannot be modified. If a reviewer needs to change their decision after signing, they must submit a new review with justification for the change. Both the original and updated decisions are retained in the audit trail.

---

Campaign Reports

After a campaign is completed, VeraID generates a summary report suitable for compliance auditors and management review.

curl https://app.veraid.io/api/v1/attestation/campaigns/{campaignId}/report \
  -H "Authorization: Bearer $API_KEY"

{
  "campaignId": "camp_9f8e7d6c-5b4a-3c2d-1e0f-a9b8c7d6e5f4",
  "name": "Q1 2026 NHI Access Review",
  "status": "COMPLETED",
  "completedAt": "2026-04-14T16:30:00Z",
  "summary": {
    "totalIdentities": 142,
    "reviewed": 142,
    "approved": 118,
    "rejected": 19,
    "escalated": 5,
    "averageReviewTime": "2.3 days",
    "slaCompliance": "94.4%"
  },
  "byType": {
    "SERVICE_ACCOUNT": { "total": 67, "approved": 58, "rejected": 8, "escalated": 1 },
    "API_KEY": { "total": 43, "approved": 38, "rejected": 4, "escalated": 1 },
    "AI_AGENT": { "total": 32, "approved": 22, "rejected": 7, "escalated": 3 }
  },
  "actionsRequired": [
    {
      "identityId": "idt_abc123",
      "identityName": "legacy-billing-bot",
      "decision": "REJECTED",
      "action": "revoke_identity",
      "reason": "Service decommissioned in Q4 2025"
    }
  ]
}

---

What’s Next

• Compliance — Map attestation campaigns to SOC 2, HIPAA, and PCI-DSS controls
• Just-In-Time Access — Replace standing privileges with on-demand credentials
• Identity Overview — Understand the identity types and lifecycle states reviewed in campaigns