Automatic signal detection
Oleria first looks for direct evidence of ownership in your connected applications. It checks a fixed set of signals in priority order, from strongest to weakest, and stops at the first priority level that identifies an owner - it does not fall back to a weaker guess once a strong signal is found.
Not every signal applies to every application. Signals marked for one provider only run for identities from that provider, and Google Cloud service accounts don’t use “Can act as this user.”
If a signal points to an account that is disabled, or has had no activity for longer than your workspace’s dormant account threshold, Oleria assigns that person’s manager instead. The manager comes from your HR or identity provider data and must have an enabled account in the same application. If there’s no such manager, that signal doesn’t produce an owner and Oleria moves on to the next signal.
Manual review when no signal is found
If none of the applicable signals identify an owner, what happens next depends on the application. If the application has its own ownership settings, the NHI is routed to the reviewers configured there - a specific reviewer, or an admin, group, or role. If it doesn’t, the NHI stays unowned and Oleria checks it again on its next daily run. If more than one reviewer is assigned, the first decision made resolves the review and closes any other pending reviews for that NHI.Oleria keeps checking for signals in the background while a review is pending. If a clear signal appears before a reviewer acts, the NHI is assigned automatically and the pending review closes on its own.