Skip to content
IdentrailIDENTRAIL
Log in

Machine identity trust graph

See every machine identity path before it becomes risk.

Identrail connects cloud, cluster, repository, and OIDC identity signals into one live risk graph so teams can prioritize exposure and ship safer access changes.

LiveDocker pulls
Collection
Read-only by default
Coverage
AWS, K8s, GitHub, OIDC
Output
Prioritized risk graph
  • Open-core under Apache-2.0
  • Read-only onboarding model
  • Self-hosted and hosted paths
  • Public docs and release history
Example workspace

Example workspace / AWS IAM

Role trust path identified
High severity
Source identityGitHub Actions OIDCExample repository / deployment workflow
Privilege boundaryAWS IAM role: billing-prodReview namespace-scoped trust
Target resourceRDS billing-ledgerProduction resource path
Owner-ready fixScope subject and namespace claimsNo critical workload impact predicted
  1. 01
    GitHub Actions OIDC signal linkedExample repository / deployment workflow
    Linked
  2. 02
    Role trust path identifiedOIDC federation reaches billing-prod
    Review
  3. 03
    Privilege boundary needs reviewNamespace-scoped access can reduce exposure
    Review
  4. 04
    Evidence references collectedTrust, workflow, and resource signals linked
    Ready

Reviewed across your identity stack

  • AWS IAM
  • Kubernetes
  • GitHub
  • OpenID
  • Terraform
  • Docker
  • PostgreSQL
  • Prometheus

Connect identity signals. Reveal the path.

AWS IAMrole assumptions and policy edges
Kubernetesservice accounts, RBAC, namespaces
GitHub/OIDCworkflow identity and token claims

Risk graph output

From signal to owner-ready fix
EvidenceReachable impactRecommended fix

One operating view for machine identity risk.

Exposure triage Illustrative example

Turn scattered identity signals into one owner-ready queue.

High confidence
Primary risk pathProduction database reachable
Signal matchAWS role + K8s service account + OIDC claim drift

Evidence

  • Trust policy allows broad workflow subject claims
  • ClusterRoleBinding grants namespace-spanning workload access
  • Reachable resource is tagged production and regulated

Operator playbook

  1. Confirm owner
  2. Review evidence bundle
  3. Prioritize first fix

How it works

From read-only signals to a safe fix.

Link IAM, Kubernetes, and OIDC evidence to see the reachable path, owner, and safest first change.

  1. 01

    Connect

    Link read-only identity sources with scoped collection.

  2. 02

    Trace

    Follow the identity path to the reachable resource.

  3. 03

    Fix

    Simulate and share the safest first change.

Example risk path

Billing ledger reachable

Read-only preview

Reachable path

GitHub Actions can reach the billing ledger.

High
IdentityGitHub Actions OIDC
PrivilegeAWS IAM role: billing-prod
Workloadpayments-api namespace
ResourcePostgreSQL billing ledger

Safest first change

Narrow the subject claim and namespace
- sub = "*"+ sub = "repo:payments-api:prod"+ namespace = "payments-api"

Evidence bundle

Ready to share with the owner
  • Source proof
  • Policy diff
  • Affected workload
  • Owner timeline

Operational Workflow

From evidence to the first safe fix

Each stage produces a reviewable artifact before any change is approved.

  1. 01 / Discover

    Build the trust graph

    Collect AWS IAM, Kubernetes, GitHub, and OIDC identity metadata in read-only mode.

    Identity graph snapshot with source evidence links

  2. 02 / Prioritize

    Rank reachable risk paths

    Score findings by severity, confidence, and production blast radius.

    Ranked findings queue with owner-ready context

  3. 03 / Simulate

    Preview hardening safely

    Preview trust-policy changes and estimate affected workloads before approval.

    Remediation plan with expected impact summary

  4. 04 / Operate

    Roll out with controls

    Stage approved changes with rollback options and track resolution outcomes.

    Audit-ready remediation timeline and status history

Adoption Paths

Choose the deployment model that fits your operating constraints.

01Maximum control

Open Source

Time to value
Same day with Docker/Kubernetes setup
Control level
Full infrastructure and data ownership
Support model
Community and docs-led
View open-source setup →
02Fastest path

Hosted SaaS

Time to value
Minutes to first trust-path scan
Control level
Managed platform with guided rollout
Support model
Product support and assisted onboarding
Start hosted evaluation →
03Private control

Enterprise

Time to value
Planned onboarding with architecture review
Control level
Private deployment and regional controls
Support model
Enterprise SLA and named partner team
Contact enterprise team →
Compare plans

Comparison

How Identrail makes trust paths easier to act on

CategoryIdentrailConventional workflows
Explainable trust pathsIdentity chain, policy evidence, and affected resourcesRisk findings without chain context
Safer remediationRead-only collection, policy simulation, and approval gatesSeparate tools and manual checks
Open visibilityOpen-core code, documentation, and release historyLimited implementation visibility

Ready to evaluate

See your first production trust path

Start with a read-only scan, review the evidence, and choose the deployment model that fits.