A governance record that preserves the identity and retirement status of an agent after the runtime object has been removed. It prevents silent reuse, supports auditability, and keeps the retired principal resolvable to an owner and an end date.
Expanded Definition
A tombstone record is the durable governance artifact that remains after an agent, service account, or other non-human principal has been decommissioned. In NHI operations, it preserves the former identity’s name, owner, scope, retirement date, and reason for removal so the principal can no longer reappear as an “unknown” object.
Definitions vary across vendors on whether tombstone records live inside an identity platform, a secrets manager, or a directory service, but the operational purpose is consistent: keep retired principals resolvable for audit, incident response, and lifecycle controls. This matters because a deleted runtime object without a retained record can be silently recreated, reassigned, or confused with a fresh identity. That is why tombstones sit alongside lifecycle governance concepts such as deprovisioning, revocation, and evidence retention, rather than being treated as a simple delete log. The NIST NIST Cybersecurity Framework 2.0 supports this kind of traceable control evidence through governance and identity management outcomes.
The most common misapplication is treating deletion as retirement, which occurs when teams remove the live object but fail to preserve a record that prevents reuse and preserves accountability.
Examples and Use Cases
Implementing tombstone records rigorously often introduces lifecycle overhead, requiring organisations to weigh faster cleanup against stronger auditability and safer reuse prevention.
- Retiring a CI/CD service account while preserving who owned it, what it accessed, and when its access ended.
- Decommissioning an API client after an application sunset, then retaining the record so a new client cannot inherit the same identity history.
- Marking an AI agent as retired when its tool permissions are removed, while keeping a reference for future incident analysis.
- Supporting offboarding workflows where secrets are revoked and the residual identity record remains traceable for audit and compliance.
- Resolving a suspected abuse event by checking whether a principal was genuinely new or was a previously retired identity with a stale name.
These use cases align with the lifecycle and offboarding concerns discussed in NHI Management Group’s Ultimate Guide to NHIs, where retirement without visibility creates downstream risk. For identity-centric control design, the NIST Cybersecurity Framework 2.0 provides a useful lens for keeping identity evidence tied to operational outcomes.
Why It Matters in NHI Security
Tombstone records matter because NHI estates are large, fast-moving, and often poorly observed. NHI Management Group notes that only 5.7% of organisations have full visibility into their service accounts in the Ultimate Guide to NHIs, which means retired principals are easy to lose track of unless the organization preserves a durable retirement trail. Without tombstones, auditors cannot reliably prove who owned an identity, incident responders cannot distinguish a resurrected principal from a new one, and governance teams cannot enforce clean offboarding.
This becomes especially important when secrets, tokens, and certificates are linked to automation or agentic workflows, because a deleted object may still leave behind live trust relationships. Tombstone records help close that gap by preserving the retirement state even after the runtime object is gone. They also support defensible retention and reduce confusion during rotation, migration, and identity consolidation. Organisations typically encounter the need for tombstone records only after a retired principal is reused or questioned during an investigation, at which point the concept becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Retired NHI records preserve lifecycle state and prevent unsafe identity reuse. |
| NIST CSF 2.0 | GV.OC-03 | Governance outcomes depend on traceable identity lifecycle evidence. |
Retain identity retirement evidence so governance teams can prove ownership, status, and end date.
