Creator versus owner distinguishes who first provisioned an identity from who is currently responsible for it. In NHI governance, the creator is historical evidence, while the owner is the living control point that should survive turnover, reorganisation, and staff departure.
Why the distinction matters
Creator and owner answer different governance questions. The creator is useful for audit history and provenance, while the owner is the person or team that can actually approve changes, renew access, and absorb responsibility when staff move on.
This distinction matters because identity records become fragile when organisations confuse “who made it” with “who should manage it now.” A clean ownership model reduces orphaned accounts, stale privileges, and the common failure mode where no one feels accountable after the original requester leaves.
How creator and owner should be used
Creator should be treated as a historical attribute, not the control point for ongoing decisions. Owner should be the field that drives review cadence, exception handling, and escalation when an identity needs to be changed, revoked, or investigated.
In practice, creator data is most useful for traceability, change reconstruction, and understanding how an identity entered the environment. Owner data is what supports day-to-day governance, because it identifies who can confirm legitimacy and who should respond when the identity no longer matches its original purpose.
Operational governance signals
This model becomes especially important after reorganisations, contractor exits, application handoffs, and service migrations. If ownership stays tied to the creator, the organisation inherits a historical record but loses a current control point.
Well-run governance treats ownership as mutable and reviewable, while creator remains fixed as evidence. That separation helps prevent assumptions that an identity is still supervised simply because it was originally provisioned by a known person or team.
What good stewardship looks like
Good stewardship means every identity has a current accountable owner, and that ownership is capable of surviving personnel turnover. The owner should be visible in the same workflow that handles access review, exceptions, and deprovisioning so the record remains operational rather than archival.
For NHI governance in particular, this is often the difference between a manageable service identity and an abandoned one. If the creator departs and ownership is never reassigned, the identity can persist with no active decision-maker, which is exactly where governance breaks down.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Creator versus owner is an account governance distinction affecting ongoing responsibility. |
| IA-5 — Authenticator Management | Ownership is the control point for lifecycle decisions over credentials and other identity material. | |
| AU-3 — Content of Audit Records | The creator attribute is provenance evidence that supports later reconstruction and review. | |
| Recommendation — Assign a current owner for every account and review it whenever responsibility changes. Track an accountable owner for credential lifecycle actions and reassignment. Record creator data as audit provenance without using it as the live control owner. | ||
| ISO/IEC 27001:2022 | A.5.18 — Access rights | The term separates historical creation from current responsibility over access rights. |
| Recommendation — Ensure access-right ownership is current and reassigned when personnel or teams change. | ||
| CIS Controls v8 | CIS-5 — Account Management | Creator-versus-owner is an account management problem centered on accountability and lifecycle control. |
| Recommendation — Maintain a current owner for each account and retire ownership promptly when roles change. | ||
Practitioner Guidance
Governance implication: Use creator only as provenance, and require a separate owner field that can be reassigned without altering historical attribution. That keeps accountability attached to the identity’s present operational reality rather than its origin.
What to watch for: Any identity whose owner still matches the original creator after team changes, service transfers, or employee exits deserves review, because that is a strong signal the governance record has not kept pace with responsibility.