Do we replace our identity provider?

No. The fabric reads from the provider and HR system you already run and adds directive-level scoping on top of them.

What about agents that run on a schedule?

A scheduled directive still resolves to the named professional whose authority it exercises. If that person's role no longer carries the authority, the directive halts.

How does this interact with the audit ledger?

The human and role are part of the hashed payload, which is what makes a committed action non-repudiable rather than merely logged.

Solutions

Identity & role-scoped authority

Authority belongs to a person and a role — never to a service account.

A credential mesh with few human nodes among a dense non-human swarm — Authority belongs to a person and a role — never to a service account.

The enterprise now runs 144 non-human identities for every human one. Agent identity answers which process acted. Directive identity answers whose authority it acted under. Only the second is defensible.

The problem

Agents inherit broad service-account permissions and act outside any role.
Registry sync records existence; it does not enforce anything at runtime.
Privilege abuse is now a named category in the OWASP agentic top ten.

The Orcher approach

Per-directive credentials bound to a named human and their role.
Least privilege that is dynamic, task-scoped, and time-bound by construction.
Instant revocation on role change, with no agent redeployment.

Machines already outnumber people

Non-human identities outnumber human ones by roughly 80 to 1 in the enterprise. Most of them hold static, shared, over-permissioned credentials that were issued for a project and never scoped down. Agentic execution turns that inventory problem into an authority problem: a process with a service account can act, and nothing in the record says whose authority it acted under.

Registries do not fix this. Knowing an agent exists says nothing about whether its next action is inside somebody's real authority.

Authority is minted per directive

The Role Identity Fabric resolves the directive to an authenticated person, resolves that person's role at that moment, and mints credentials scoped to the directive alone — task-bound, time-bound, expiring on completion. Median role scope in deployment is about 14% of the underlying account's permissions.

Revocation is immediate. A role change, suspension, or termination invalidates authority at the next gate with no agent redeployment, and the ledger keeps the role that authorized each already-committed action so history stays accurate.

From will-not to cannot

Policy documents describe what an agent will not do. Role-scoped authority describes what it cannot do, because the credential it holds does not carry the permission. That distinction is the whole argument: the first is a statement of intent, the second is an enforced boundary.

It is also the difference between an incident that is embarrassing and one that is unbounded. A compromised agent operating on a 14% scope, task-bound and expiring, has a materially smaller blast radius than one holding a standing service account.

Three widening phases of deployment moving across a dark field — One workflow, proven end to end, before anything scales.

Rollout

How a deployment actually starts

One workflow, proven end to end, before anything scales.

01
Inventory standing credentials
Identify the shared and service accounts agentic work currently borrows, and what each can actually reach.
02
Model roles, not users
Express real authority — approval limits, populations, jurisdictions — as roles your identity provider and HR system can assert.
03
Mint per-directive credentials
Cut one workflow over to task-bound, time-bound credentials and measure the scope reduction.
04
Retire the standing account
Remove the shared credential once the workflow runs entirely under minted authority.

What you get

~14% median scope

Per-directive credentials carry a fraction of the underlying account's permissions.

Instant revocation

Role changes invalidate authority at the next gate with no redeployment.

Attributable actions

Every committed action names the human and role whose authority it exercised.

Questions

What enterprises ask first

Do we replace our identity provider?: No. The fabric reads from the provider and HR system you already run and adds directive-level scoping on top of them.
What about agents that run on a schedule?: A scheduled directive still resolves to the named professional whose authority it exercises. If that person's role no longer carries the authority, the directive halts.
How does this interact with the audit ledger?: The human and role are part of the hashed payload, which is what makes a committed action non-repudiable rather than merely logged.

Most often bought for