The most powerful identities in many companies are not people — they are pipelines. A CI/CD token or an OIDC trust policy with a wildcard can let any branch, any fork, or any repo deploy to production. These identities are created in a hurry, rarely reviewed, and almost never scoped down, which is exactly why they keep showing up in breach postmortems.
The outcomes, not just an alert.
- Discover CI/CD tokens, OIDC trust relationships, and pipeline service accounts that reach prod
- See the exact exposure on a wildcard trust policy — which branches and repos can actually deploy
- A proposed fix you can ship as a pull request, scoped down to least privilege
- A Verifiable Trust Receipt proving the change reduced reach, not expanded it
- Human-approved and reviewable — every fix ships as a PR you merge, nothing is changed silently
Three steps to a provable result.
Pipeline identities and their OIDC trust are mapped agentlessly, so you can see which ones actually hold a path into production.
A wildcard trust policy is resolved into the concrete set of branches and repos that can deploy — the real blast radius, not the policy on paper.
A least-privilege change arrives as a pull request with a signed receipt, so you can confirm reach only got smaller before it merges.