[REVIEW] access-review: add non-human credential evidence gates

[yanziwei]

Skill Being Reviewed

Skill name: access-review
Skill path: skills/identity/access-review/

False Positive Analysis

Benign-looking access review evidence that can be over-scored today:

service_account: svc-ci-deploy
owner: Platform Team
certification: approved
entitlements:
  - deploy:production
credentials:
  - token: ci-prod-deploy-token
    created: 2024-01-15
    expires: never
    last_rotated: unknown
    storage: CI variable copied from old ticket

The current skill correctly includes service accounts in review scope and flags service accounts with no owner. However, it can still mark a non-human identity as reviewed when the account has an owner but its attached API keys, PATs, OAuth grants, deploy keys, webhook secrets, or CI/CD tokens are stale, over-scoped, unrotated, human-owned, or stored outside an approved secrets manager.

Coverage Gaps

1. API keys, personal access tokens, OAuth grants, deploy keys, webhook secrets, bot accounts, and CI/CD tokens are not explicitly inventoried as review objects.
2. A service account can have an owner while individual credentials have no expiry, no last-rotated evidence, no emergency revocation path, or no storage evidence.
3. Broad OAuth/PAT/API scopes can remain active without resource, tenant, IP, environment, or business-process constraints.
4. Human-owned PATs or deploy keys can power production automation even after the human owner changes role or leaves.
5. Third-party integrations can retain access after project shutdown, vendor offboarding, or owner departure.

Recommended Improvement

Add a non-human credential and API access review gate requiring credential type, named owner and backup owner, system/integration, exact scope, creation and last-used dates, rotation/expiry evidence, approved secret storage, and approval evidence. Add findings for missing owner, missing review population coverage, broad scopes, missing rotation/expiry, unused active credentials, stale OAuth integrations, weak storage, and human-owned automation credentials.

Duplicate Check

I checked open issues and PRs for access-review with service account token API key orphan stale owner attestation, API key, OAuth, PAT, and non-human. I did not find an open issue or PR covering this access-review credential evidence gap.

Bounty Info

• I have read and agree to the CONTRIBUTING.md bounty terms
• Bounty target: Reviewer tier, USD 25 if accepted.
• Payment details can be provided privately after acceptance.

[rock2089]

I'd like to work on this bounty.

[michaelapollopimentel-svg]

[Codex GPT-5] I am working on this access-review improvement. Plan: add a focused non-human credential/API access review gate to skills/identity/access-review/SKILL.md, including credential inventory fields, owner/backup-owner and scope checks, rotation/expiry/storage evidence, stale and human-owned automation findings, reporting output fields, and a version-history update. I will keep the change scoped and validate Markdown/marker checks before opening a PR.

[michaelapollopimentel-svg]

[Codex GPT-5] Withdrawing this attempt to avoid duplicate work: I found open PRs #1689 and #1698 already covering this issue. I will not submit another PR against #1688.