I have spent my career inside cloud IAM systems — at the level where you debug an `sts:AssumeRole` chain by hand and still wonder if you missed a hop. The honest truth is that almost nobody knows what their non-human identities can reach. They have signals, they have detections, they have queues full of findings. What they do not have is a clear, evidence-grounded answer to the only question that matters: what can this identity touch, and what would actually break if I took that reach away?
That gap is where the breaches happen. That gap is what Identrail closes. Open core, because security tools you cannot read are security tools you cannot trust. Read-only by default, because the right way to start is by looking. Path-grounded severity, because nobody has the attention budget for theoretical risk anymore.
We are early. We are building in public. If any of this resonates, talk to us — by email, on Discord, or on the repo. The product gets better when the people who care about it tell us where it is wrong.
Founder & CEO
I build and secure IAM systems across cloud and distributed environments, with a focus on least-privilege architecture for both human and machine identities.
I am a member of the AWS Community Builders program and of The Identity Underground, the Silver Fort–backed community for identity-security practitioners.
Founding engineers (graph, detection, simulator), founding designer, and a security lead. Remote-friendly. Equity-meaningful. Send a note to hello@identrail.com.
You should never have to leave the trust graph to do anything important. Find a finding, click into the path, simulate the fix, route it to an owner — same surface, no exports.
Every connector is read-only by default. Enforcement is a separate, opt-in surface. We will never ship a feature that requires write access without naming exactly what it writes and why.
The detection logic, the simulator, the connectors — all of it is in the public repo. If a buyer cannot read the source of a security tool, they cannot trust it. We chose Apache 2.0 on purpose.
A finding is "high" only when the path resolves to data, money, or control. We refuse to ship a tool that floods you with theoretical risk. The point is to surface what matters and stay quiet otherwise.