I'm working on credential governance and trying to understand how teams manage accounts that never enter the usual identity lifecycle. This includes break-glass accounts, contractor logins, shared credentials, shadow IT, and applications that don't support SAML or OIDC. These accounts often end up in personal or shared vaults, get duplicated across teams, or remain tied to one employee. How do you handle ownership when someone leaves, decide who should retain access, rotate credentials, and audit usage? I'm especially interested in what works in practice, what tends to fail, and what you wish password managers, PAM, or identity governance tools handled better.
2 Answers
Break-glass and shared accounts work best as owned secrets rather than anonymous passwords. We assign a named primary owner and backup, keep the credential in one audited vault, and rotate it whenever an owner or authorized user departs. Personal copies are the biggest problem because they bypass the audit trail and are easy to miss during offboarding.
A straightforward process is to record the owner and their manager or backup in the identity system, then require an annual access review. The owner has to confirm that access is still needed. It’s not perfect, especially for accounts outside formal role-based access, but recurring attestations create a useful inventory and force someone to notice stale credentials.
Moving an item between vaults isn’t enough by itself. Someone still needs to formally accept responsibility for the underlying account and its recovery methods.