Start by discovering where identities actually exist inside applications, not just where they are recorded in IAM. Then reconcile those findings with access policy, ownership, and review processes. Hidden application identities often include secrets, service accounts, and token-based trust that were never brought fully under governance.