Sarghaby Araghatta
Request a free assessment →
Home / Machine identities

Bring the identities with no human behind them under review.

Sargha treats every agent, tool server and key as a governed identity: what it can reach, who owns it, and whether it should still exist.

DiscoveredWith its reach and abroad-reach flagRecertifiedStill needed, every 90 daysDecommission requestedA decision that drives removalRetiredGone, with the record keptDiscoveredWith its reach and a broad-reachflagRecertifiedStill needed, every 90 daysDecommission requestedA decision that drives removalRetiredGone, with the record kept
Every decision is a record: who, when and why.

Effective reach, not a name

For each identity: what it can call, what it holds, where it can send data and the cloud data it can reach.

An owner for every identity

An accountable owner, a business criticality and a lifecycle state, so an agent gets the review a person would.

Broad and orphaned ones stand out

Identities that look over-privileged or unused are flagged first.

Recertify on a rhythm

Attest that an identity is still needed, with reviewer, owner and reason on record. Overdue ones are flagged. New identities start as proposed and are reviewed before they are active.

Honest about removal

Decommission is a recorded decision. The sensor is read-only and does not revoke a key itself: you or an integration carry it out in your identity provider or cloud, and the audit log keeps the call and the evidence.

How it works

Step by step.

  1. Discover

    Agents, tool servers and keys are found by the sensor and connectors.

  2. Review

    Each one shows its reach, its owner and its criticality, with broad and orphaned ones flagged.

  3. Decide

    Keep it, narrow it or retire it, with who decided, when and why on record.

Questions

Common questions.

Does Sargha revoke keys?
No. The sensor is read-only. Decommission is a recorded decision that you or an integration carry out in your identity provider or cloud.
How often are identities reviewed?
Recertification runs on a 90-day cadence and overdue ones are flagged. You can also run a campaign over a chosen set.
What counts as an identity?
AI agents, tool servers, service accounts and long-lived keys that act on your behalf.
Who reviews an identity?
A named reviewer records the decision with the owner and the reason, so a machine identity gets the same discipline as a human one.
Is reach a claim of use?
No. Reach is what permissions allow, computed from evidence. It does not claim that the identity has already used the path.
What you need
  • The AI inventory from sensors and connectors.
  • A reviewer for each recertification round.
For your technical team

Data handling and access detail for reviewers are in the technical pack, shared with your team under NDA.

Request the demo and technical pack
Get started

See the AI on your fleet in about a week.

Run the sensor across your estate and receive an AI risk report and an AI Bill of Materials. The assessment is free and carries no commitment.

Request a free assessment → Book a 30-minute call