Identity Overview

VeraID provides a unified control plane for managing every non-human identity (NHI) in your organization. An identity represents any automated actor that authenticates, accesses resources, or performs actions on behalf of your organization — from service accounts and API keys to autonomous AI agents and IoT endpoints.

NHI Types

VeraID classifies non-human identities into seven distinct types, each with purpose-built governance capabilities.

Type	Description	Common Use Cases
SERVICE_ACCOUNT	Machine-to-machine authentication	Microservice communication, database access, internal API calls
API_KEY	External API access credentials	Third-party integrations, partner access, public API consumers
OAUTH_TOKEN	OAuth application integrations	SSO-connected apps, marketplace integrations, delegated access
CI_CD	Deployment pipeline identities	GitHub Actions, GitLab CI, Jenkins, ArgoCD, Terraform runners
AI_AGENT	Autonomous AI systems with budget controls and prompt injection detection	LLM-powered workflows, MCP tool servers, autonomous agents
IOT_DEVICE	IoT device endpoints	Edge sensors, embedded controllers, connected hardware
KUBERNETES_POD	Kubernetes workload identities	Pod service accounts, sidecar proxies, CronJob runners

Tip

AI Agent identities include specialized governance features such as budget enforcement, prompt injection detection, model usage tracking, and MCP tool governance. See the AI Agent Security section for details.

Identity Fields

Every identity in VeraID carries a standard set of fields that drive policy evaluation, risk scoring, and audit logging.

Field	Type	Description
id	string	Unique identifier (UUID v4), assigned at creation
name	string	Human-readable display name
type	enum	One of the seven NHI types listed above
status	enum	Current lifecycle state: ACTIVE, SUSPENDED, or REVOKED
description	string	Free-text description of the identity’s purpose
metadata	JSON	Arbitrary key-value metadata (e.g., team, cost center, environment)
tags	string[]	Labels for filtering and grouping (e.g., production, critical)
allowedIPs	string[]	IP allowlist for request origin validation (CIDR notation supported)
allowedOrigins	string[]	Permitted HTTP origins for CORS-style enforcement
riskScore	number	Dynamic risk score from 0 (low) to 100 (critical), auto-calculated
lastUsedAt	datetime	Timestamp of the most recent authenticated action
expiresAt	datetime	Optional expiration date; identity auto-suspends after this time
agentConfig	JSON	AI agent-specific configuration (budget limits, allowed models, MCP policies)
createdAt	datetime	Timestamp of identity creation
updatedAt	datetime	Timestamp of last modification

Example Identity Object

{
  "id": "idt_8f14e45f-ceea-462a-a5e7-7b3e50a8b72c",
  "name": "payment-processor",
  "type": "SERVICE_ACCOUNT",
  "status": "ACTIVE",
  "description": "Handles payment gateway communication for the billing service",
  "metadata": {
    "team": "payments",
    "costCenter": "ENG-042",
    "environment": "production"
  },
  "tags": ["production", "pci-scope", "critical"],
  "allowedIPs": ["10.0.0.0/16", "172.16.0.0/12"],
  "allowedOrigins": [],
  "riskScore": 12,
  "lastUsedAt": "2026-03-19T08:42:11Z",
  "expiresAt": null,
  "agentConfig": null,
  "createdAt": "2025-11-01T14:30:00Z",
  "updatedAt": "2026-03-18T22:15:44Z"
}

AI Agent Configuration

Identities of type AI_AGENT support an agentConfig object with additional governance controls:

{
  "agentConfig": {
    "budgetLimit": 500.00,
    "budgetPeriod": "monthly",
    "budgetUsed": 127.43,
    "allowedModels": ["gpt-4o", "claude-sonnet-4"],
    "maxTokensPerRequest": 8192,
    "promptInjectionDetection": true,
    "mcpServers": ["database-readonly", "slack-notifications"],
    "mcpToolPolicy": "allowlist"
  }
}

Lifecycle States

Every identity follows a defined lifecycle with three states. Transitions are audited and trigger configurable notifications.

┌──────────┐     suspend      ┌────────────┐     revoke     ┌──────────┐
│  ACTIVE  │ ───────────────► │ SUSPENDED  │ ──────────────► │ REVOKED  │
│          │ ◄─────────────── │            │                 │          │
└──────────┘    activate      └────────────┘                 └──────────┘
      │                                                            ▲
      │                         revoke                             │
      └────────────────────────────────────────────────────────────┘

ACTIVE

The identity is fully operational and can authenticate, access resources, and perform actions according to its assigned policies. All new identities start in this state.

SUSPENDED

The identity is temporarily disabled. All authentication attempts are rejected, and in-flight sessions are invalidated. Suspension is reversible — an administrator can reactivate a suspended identity, restoring it to ACTIVE status.

Common reasons for suspension:

• Elevated risk score exceeding a policy threshold
• Owner offboarding investigation
• Scheduled maintenance window
• Pending credential rotation

REVOKED

The identity is permanently decommissioned. All credentials are invalidated, policy bindings are removed, and the identity cannot be reactivated. Revocation is an irreversible terminal state.

Danger

Revoking an identity is a permanent action that cannot be undone. All associated credentials are immediately invalidated, and any systems relying on this identity will lose access. Always verify downstream dependencies before revoking.

Common reasons for revocation:

• Owner has left the organization
• Identity confirmed as compromised
• Service or application permanently decommissioned
• Compliance-driven cleanup of unused identities

What’s Next

• Managing Identities — Create, update, and manage identities via the API
• Risk Scoring — Understand how VeraID calculates and uses risk scores
• Identity Groups — Organize identities and apply policies at scale