Service accounts
Agents borrow service accounts built for something else, and inherit every permission the account ever collected. nerl0 shows which ones they reuse and what those accounts open.
One key, three callers
A service account was made for one job. Then a script used it, then an agent. The account never changed, but who it works for did.
Why a service account turns risky
It takes three habits that look harmless one at a time.
Read the AcademyOne account was created for a pipeline. A script borrowed it, then an agent. Now nobody can say who actually used a call.
The key was made once and never rotated. Everyone who ever saw it can still use it, and it works from anywhere.
Each new job added a permission and none was removed. The account holds the union of everything it was ever used for.
See every account an agent reuses
nerl0 reads service accounts from your cloud and identity platforms, and marks the ones an AI agent has been seen using. You see who shares a key, how old it is and what it reaches.
- SharedAccounts used by more than one caller, with the agent called out.
- AgingKeys that have never been rotated, sorted to the top.
- ReachingThe crown-jewel data each account can get to.
Follow the account to the data
The account itself is not the problem. The path is: an agent holds the key, the key assumes a role, and the role reaches data nobody meant the agent to touch. nerl0 draws that path and marks the one hand-over to cut.
- Authority pathEvery step is a configured relationship, not a guess.
- BreakpointThe single change that closes the most paths.
- ProvenThe next scan checks that the path is gone.
Give each caller its own identity
The fix is not a new tool. It is splitting one account into narrow ones, each with an owner.
Rotate, assign, verify
Narrowing an account is a small change with a clear owner. nerl0 turns it into an issue, and the next scan shows whether it held.
- Assign an ownerEvery service account gets a person who answers for it.
- Rotate the keyOld keys are rotated or retired, not left to age.
- Check on the next scanThe path is gone, or the issue stays open.
Activity
Questions to ask
These come straight from the Question Library. Activate them in your own workspace.
Browse all questionsMore solutions
Other ways into the same map of authority.
Browse the Academy