11.0 Identities
One register, humans and machines
The directory a control asks about: who is here, what they can reach, and which logins answer to nobody.
Directory
Everyone and everything that holds access: employees, contractors, service accounts and agents. Platform seats are linked to a row here, never the other way round.
11.1
Not a staff list
A service account and an AI agent are rows in the same register as an employee, because a control that asks who holds admin access does not care which of them does.
11.2
Accounts correlated to people
Entra ID, Google Workspace, GitHub and AWS principals are matched to the identity that holds them. What one person can actually reach is one query, not four exports.
11.3
Unclaimed accounts surface
A login no identity claims sits in its own queue until somebody links it, promotes it to a service account of its own, or marks it a shared mailbox — with the reason recorded.
Provable today, not at audit time.
Run it yourself or have Bindsec run it for you. Either way, the evidence is current and the posture is one place.