Configuration

Access Through Non-Human Identity

Vendor-Embedded AI

ID: CF003
Created: 26th August 2026
Updated: 26th August 2026
Contributor: James Weston

Access Through Human Identity

Access through human identity occurs when a synthetic subject is configured to use a human employee’s account, session, token, credentials, browser profile, or delegated permissions to access systems or perform actions. This may occur where an employee connects an artificial intelligence tool to their mailbox, browser, source repository, cloud console, productivity suite, or business application using their own identity.

This configuration creates an elevated exposure condition because the synthetic subject inherits the employee’s access, trust, and attribution trail. Actions taken by the synthetic subject may appear in logs as ordinary human activity, even where the employee did not review each action or understand how the synthetic subject used their access.

The primary risk is identity inheritance. The synthetic subject may retrieve data, send messages, modify records, run commands, or trigger workflows using permissions granted to the human account. This makes it difficult to distinguish direct employee behavior from AI-mediated action.

Investigators should review authentication sessions, OAuth grants, connected applications, browser extensions, delegated permissions, endpoint activity, application logs, prompt and response records, tool-call logs, and user activity timelines. Particular attention should be given to AI tools operating inside authenticated user sessions, personal automation scripts, browser agents, local coding assistants, and third-party AI services connected through employee-granted access.

Investigative Relevance

Access through human identity is relevant because it defines what a synthetic subject can do by borrowing the reach of a human account. This weakens identity-based investigation, access governance, and containment because disabling or restricting the synthetic subject may require examining the employee’s sessions, devices, integrations, and delegated grants.

Subsections (6)

ID	Name	Description
CF003.002	Authenticated User Session Access	Authenticated user session access occurs when a synthetic subject operates inside an employee’s active browser, desktop, or single sign-on session. This may include browser agents, desktop agents, computer-use agents, local assistants, or automation tools that interact with applications already authenticated as the employee. This configuration creates an elevated exposure condition because the synthetic subject can act through the employee’s live session, cookies, tokens, permissions, and application state. It may navigate pages, read rendered content, submit forms, download files, copy data, or trigger actions as if the employee performed them directly. The primary risk is session inheritance. The synthetic subject may access systems or perform actions without separately authenticating, and logs may show ordinary employee activity rather than AI-mediated behavior. Investigators should review browser session records, endpoint telemetry, single sign-on logs, clipboard activity, form submissions, download history, visited URLs, automation traces, and application audit logs. Particular attention should be given to agent activity inside authenticated sessions, actions following external page interaction, and events lacking a distinct synthetic subject identity. Investigative Relevance Authenticated user session access is relevant because it allows a synthetic subject to use the employee’s active trust state. This sub-section is especially relevant where AI tools operate through browsers, remote desktops, local applications, cloud consoles, or authenticated business platforms.
CF003.004	Delegated Mailbox and Calendar Access	Delegated mailbox and calendar access occurs when a synthetic subject is granted permission to read, summarize, draft, send, forward, schedule, or route communications through an employee’s mailbox or calendar. This configuration creates an elevated exposure condition because the synthetic subject can act through high-trust communication channels. It may process inbound messages, retrieve attachments, summarize threads, send replies, schedule meetings, forward information, or route calendar events using the employee’s communication context. The primary risk is communication authority through a human identity. A synthetic subject may disclose sensitive information, send unauthorized messages, create misleading commitments, forward internal content, or schedule actions that appear to come from the employee. Investigators should review mailbox permissions, calendar permissions, delegated access grants, OAuth scopes, sent items, forwarding behavior, calendar event history, prompt logs, and message audit records. Particular attention should be given to external recipients, sensitive attachments, unusual forwarding, automated replies, and calendar actions associated with AI tools. Investigative Relevance Delegated mailbox and calendar access is relevant because mail and calendar systems are trusted channels for organizational action. This sub-section is especially relevant where AI tools can send messages, forward content, schedule meetings, process attachments, or act on inbound communications through a human account.
CF003.001	Delegated User Account Access	Delegated user account access occurs when a synthetic subject is granted access to organizational systems through a human employee’s account authorization. This may include OAuth consent, connected application approval, browser authorization, account linking, or delegated access granted through a productivity, development, or business platform. This configuration creates an elevated exposure condition because the synthetic subject can use permissions that were originally assigned to the employee. The employee may approve the connection once, while the synthetic subject continues to retrieve data, call tools, summarize content, or perform actions within the scope of that delegated grant. The primary risk is inherited access without equivalent oversight. A synthetic subject may access mail, documents, repositories, records, or application data through the employee’s authorization, even where the employee does not review each retrieval or action. Investigators should review OAuth grants, connected applications, user consent records, delegated permissions, application scopes, access logs, revocation history, and vendor integrations. Particular attention should be given to broad scopes, persistent grants, third-party AI services, and delegated access that bypasses central synthetic subject governance. Investigative Relevance Delegated user account access is relevant because it allows a synthetic subject to operate using permissions granted to a human account. This sub-section is especially relevant where employees authorize AI tools to access mailboxes, calendars, cloud drives, source repositories, customer records, or productivity suites.
CF003.005	Developer Account Tool Access	Developer account tool access occurs when a synthetic subject can use an employee’s development accounts, tools, repositories, terminals, package registries, cloud consoles, or continuous integration and continuous delivery systems. This configuration creates an elevated exposure condition because the synthetic subject may inherit engineering access that can affect source code, build pipelines, dependencies, infrastructure, secrets, or production services. Coding assistants, terminal agents, and repository-aware tools may act through credentials and sessions intended for the developer. The primary risk is AI-mediated engineering change under a human account. A synthetic subject may commit code, alter dependencies, run commands, call cloud APIs, publish packages, modify configuration, or trigger builds in a way that appears attributable to the developer. Investigators should review source control logs, commit metadata, integrated development environment telemetry, terminal history, cloud audit logs, package registry activity, continuous integration logs, and tool-call records. Particular attention should be given to generated diffs, dependency changes, package publishing, command execution, and production-affecting actions under a developer identity. Investigative Relevance Developer account tool access is relevant because human development credentials often carry high-impact engineering authority. This sub-section is especially relevant where synthetic subjects operate in integrated development environments, terminals, source repositories, cloud consoles, build systems, or package registries.
CF003.003	Local User Credential Access	Local user credential access occurs when a synthetic subject can access credentials, tokens, keys, certificates, session files, or secrets stored in an employee’s workstation or development environment. This may include environment variables, command-line profiles, password manager access, cloud configuration files, package registry tokens, Secure Shell (SSH) keys, local application secrets, or local AI tools that can control the computer through the keyboard, mouse, browser, terminal, or graphical user interface. This configuration creates an elevated exposure condition because the synthetic subject may discover and use credentials that were not intentionally granted to it. Local assistants, coding agents, terminal-capable agents, browser agents, or computer-use agents may inherit access to files, sessions, shells, profiles, clipboard contents, credential stores, or environment state containing sensitive credentials. The primary risk is unintended credential use. A synthetic subject may read, copy, transmit, or apply local credentials to access systems beyond its intended scope, including source repositories, cloud environments, databases, internal tools, or production services. Investigators should review endpoint file access, shell history, environment variables, credential stores, local configuration files, password manager events, source repository access, browser activity, clipboard activity, and tool runtime permissions. Particular attention should be given to AI tools with file-system access, terminal access, browser control, graphical user interface control, broad workspace access, or access to developer credential locations. Investigative Relevance Local user credential access is relevant because credentials stored for human convenience may become usable by a synthetic subject. This sub-section is especially relevant where local AI assistants, coding assistants, terminal agents, browser agents, or computer-use agents operate on employee workstations with access to the same local resources as the user.
CF003.006	Privileged User Access	Privileged user access occurs when a synthetic subject operates through an administrator, security, finance, Human Resources, legal, production support, or other high-impact human account. This configuration creates an elevated exposure condition because the synthetic subject inherits sensitive access assigned to the privileged user. It may operate inside administrative consoles, security tools, finance systems, personnel records, production environments, cloud platforms, or regulated data stores. The primary risk is privileged action without equivalent human control. A synthetic subject may retrieve sensitive records, modify controls, approve transactions, change configurations, access secrets, run commands, or expose regulated data while appearing to act as the privileged employee. Investigators should review privileged session logs, administrative actions, security tool activity, cloud audit records, finance approvals, personnel record access, endpoint telemetry, prompt records, and tool-call logs. Particular attention should be given to AI tool activity during privileged sessions, actions outside normal administrative workflows, and changes lacking clear human review. Investigative Relevance Privileged user session access is relevant because it places a synthetic subject inside the highest-impact human access paths. This sub-section is especially relevant where AI tools assist administrators, security analysts, finance users, legal staff, Human Resources personnel, production engineers, or other privileged roles.

Configuration