Certify the authority, whatever the actor.
Service accounts, workload identities and AI agents outnumber people many times over, and most organisations cannot say who owns them. The market fights over what an agent can access. REVIEWIT answers a different question: who authorised it, did a human decide, and can you prove it afterwards.
Everyone is on the first. Nobody is on the fourth.
1. What can it access?
The permission graph. Crowded, well funded, and not where certification lives.
2. Who authorised it?
A named owner, accountable, with a reason for the identity to exist at all.
3. Did a human decide?
Not a policy, not an automation. A person, on a date, with a comment.
4. Can you prove it?
Six months later, to a regulator. Sealed, chained, exportable. This is REVIEWIT's question.
The obligation is periodic. The motion is the same.
Human oversight with the capacity to intervene, automatic logs retained, demonstrability on request. The AI Act asks of agents what DORA and NIS2 already ask of people: show, periodically, that a human authority supervises. The certification campaign does not change. Its subject does.
- The question changes. For a person: should this access continue? For a non-human identity: who owns this, and why does it still exist?
- The policy exists. Ownership and orphan policies already carry minimum owners, acceptance, designation strategies and deadlines. They apply to a service account as they apply to a site.
- The proof exists. A named human's decision, signed off, sealed into the audit trail. Whatever the actor being certified.
We govern our own agent first.
RITA's ledger records, for every turn, what the assistant actually did and with which tools, under whose session. That is the primitive an agent governance needs: not what it was allowed to do, but what it did, and under whose authority. REVIEWIT applies to its own AI what it will apply to yours.
Start with the ownership attestation.
Name an owner, justify the existence, set a deadline. It is the campaign every non-human identity programme starts with, and REVIEWIT runs it today.