The Ordrani platform
An AI-native platform for machine identity behavior.
Ordrani uses specialized AI models for identity behavior, workflow provenance and cross-system correlation, so that security teams can see what their automation is doing, judge whether it should be, and act on evidence rather than alerts.
Platform overview
Six capabilities. One evidence model.
The platform is organized as a pipeline of intelligence. Events from source control, cloud control planes and workloads are normalized into a common model. Four AI models then examine that data from different angles: how each identity behaves, which workflow is responsible, how events relate over time, and whether a sequence amounts to a threat.
Their conclusions converge on a single evidence model, which is why an investigation in Ordrani reads as one coherent account rather than a collection of alerts from separate detectors.
Ordrani platform architecture
Data sources · read-only
GitHub
SupportedWorkflow runs, audit events, OIDC claims
AWS
SupportedCloudTrail management and data events, IAM configuration
Workloads
Coming soonService, container and application logs
Streaming ingestion and normalization
AI models
01
Machine learning
Identity Behavior Models
Learned baselines of what each machine identity accesses, modifies and executes.
02
Probabilistic attribution
Workflow Provenance Engine
Links cloud sessions to the repository, workflow and run that produced them.
03
Graph learning
Temporal Identity Graph
Time-aware relationships between executions, identities, actions and resources.
04
Sequence models
Sequence Reasoning
Correlates connected operations and weighs the evidence for a threat progression.
AI investigation and decision layer
One case per threat, with evidence, confidence and impact.
How the platform works
From raw telemetry to a decision, in six stages.
Each stage adds context the next depends on. The AI is only as good as the evidence it receives, so the platform invests as much in assembling that chain as in the models themselves.
01
Observe
Collect workflow, identity and cloud API events through read-only integrations.
02
Normalize
Validate, deduplicate and order events into a common model with resolved identities.
03
Attribute
Link cloud sessions to the executions that produced them, with stated confidence.
04
Model
Compare activity with each identity’s learned behavior and its workflow’s purpose.
05
Correlate
Connect related deviations across systems and time into candidate sequences.
06
Investigate
Open one prioritized case with evidence, assessment and recommended actions.
Platform components
What each component does, and why it matters.
01Machine identity visibility
Know which machine identities exist, and which of them are active.
Detection begins with an accurate picture of the population being protected. Ordrani assembles an inventory of machine identities from cloud IAM configuration, trust policies and observed activity — including the federation relationships that allow a CI/CD workflow to become a cloud principal.
The inventory is built from behavior as well as configuration. An identity that holds broad permissions but has not been used in months is a different risk from one exercising those permissions every hour, and both are shown in context.
What it produces
- An inventory of monitored roles, service accounts and workload identities
- Federation paths: which repositories and workflows can assume which roles
- Activity status, last use and dormant permissions for each identity
- Ownership and environment context, where it can be established
02Behavioral intelligence
A continuously learned model of how each identity operates.
Ordrani maintains an identity behavior model for every monitored machine identity. Because automation is far more regular than human activity, departures from its routine are unusually informative — when the baseline is precise.
Models are change-aware. A new application version may legitimately call new APIs; Ordrani accounts for approved releases, infrastructure changes and maintenance windows so that expected evolution is absorbed rather than reported.
What it produces
- Per-identity behavioral profiles across seven dimensions
- Deviation signals with the specific dimension and magnitude involved
- Baselines that adjust for approved releases and planned change
Identity behavior model
prod-deploy-role · distinct resources accessed per session
Execution timing
Schedules, cadence, burst patterns and the windows in which an identity is normally active.
API usage
Which operations are invoked, in what proportion, and in what order within a session.
Resource scope
The services, accounts, regions and individual resources an identity regularly touches.
Permission utilization
The subset of granted permissions actually exercised — and the dormant remainder.
Identity relationships
Roles assumed, roles chained and identities that habitually operate together.
Execution context
Repository, branch, environment, workflow and runner associated with activity.
Data volume
Request and transfer magnitudes, where the underlying telemetry exposes them.
03Workflow provenance
Every operation, bound to the automation that produced it.
The Workflow Provenance Engine connects cloud activity to its source: the repository, workflow file, branch, environment and run that federated into the cloud and created the session. With that link established, Ordrani can evaluate activity against what the workflow is meant to do — not only against what its identity has done before.
Attribution is treated as evidence with a measurable quality. Some links are proven by identifiers; others are inferred from timing and context. Ordrani records which is which, and tracks the proportion of activity it can attribute with confidence as a first-class metric.
What it produces
- Lineage from repository and workflow to role session and API call
- An explicit attribution level on every link
- Purpose deviation: activity inconsistent with a workflow’s declared function
- Attribution coverage — the share of relevant events reliably linked
01
Repository
org/payments-service
workflow file
02
Workflow
deploy.yml · production
run id
03
Execution
run 4182 · job deploy
OIDC claims
04
Federated token
sub · job_workflow_ref
AssumeRoleWithWebIdentity
05
Role session
prod-deploy-role
session ARN
06
Operations
API calls and resources
Confirmed attribution
The link is established by verifiable identifiers — OIDC claims bound to a role session, a session ARN recorded on each API call. Ordrani treats these as fact.
Strong correlation
The link is supported by multiple independent signals such as role, timing, source network and resource overlap, but no single identifier proves it.
Unverified hypothesis
A plausible explanation the evidence does not yet support. Shown to analysts as a question to resolve, never as a conclusion.
04Threat correlation
Connecting deviations that would otherwise be read as noise.
The Temporal Identity Graph records how executions, sessions, operations and resources relate — and when. It allows Ordrani to ask questions that flat event logs cannot answer easily: what else did this session touch, which identities did it lead to, and did the activity continue after the workflow ended?
Sequence Reasoning then evaluates connected events as a progression. An unusual list operation is weak evidence alone; followed by access to a secret and a policy change, it is a pattern worth an analyst’s time. A graph relationship is never treated as proof of causation — the attribution level travels with every edge.
What it produces
- A time-ordered graph of executions, identities, actions and resources
- Candidate sequences linking related deviations across systems
- Pattern classification such as discovery, escalation and sensitive access
Temporal identity graph
Every edge carries its time and the strength of its evidence.
05Investigation
One case per threat, written from the evidence.
The investigation workspace presents a single case in place of many alerts. It brings together the timeline, the identity and workflow involved, the attribution evidence, the resources affected and what remains unknown.
An evidence-grounded language model drafts the case narrative, constrained to the events and context the case contains and required to cite them. It explains; it does not decide. Analysts confirm, dismiss or escalate — and those decisions feed back into detection quality.
What it produces
- A reconstructed, cross-system timeline for each case
- A plain-language assessment grounded in the case’s own evidence
- Affected assets, open questions and recommended next steps
- Analyst feedback that improves future detection
CASE OR-0142 · OPENED 14:42 UTC
Potential workflow identity misuse
Identity prod-deploy-role · origin deploy.yml #4182
Reconstructed sequence
- 14:32:05
sts:AssumeRoleWithWebIdentity
org/payments-service · environment: production
Confirmed - 14:32:41
ecs:UpdateService
payments-api · task definition rev 212
Confirmed - 14:33:40
iam:ListRoles, iam:ListPolicies
37 calls in 52 s · first observed for this identity
EnumerationConfirmed - 14:36:12
secretsmanager:GetSecretValue
prod/db-credentials · classified sensitive
Sensitive accessCorrelated - 14:41:50
iam:PutRolePolicy
inline policy added to reporting-export-role
Privilege changeCorrelated
Assessment
A deployment identity performed role enumeration it has never performed, then a sensitive secret was read by the same role after the run completed. The sequence is consistent with credential or workflow misuse. Authorization of the run has not been confirmed.
Affected assets
- prod/db-credentials
- reporting-export-role
- payments-api (ECS)
Recommended next steps
- 1.Confirm with the repository owner whether run 4182 was an authorized deployment.
- 2.Review active sessions for prod-deploy-role and their source networks.
- 3.Inspect the inline policy added to reporting-export-role.
- 4.Revoke sessions and restrict the role trust policy — requires approval.
06Risk prioritization
Rank by consequence and evidence, not by novelty.
Unusual is not the same as dangerous. Ordrani weighs each case against the factors that determine real risk, so that a novel but harmless read is not ranked alongside a confirmed privilege change touching production secrets.
The factors are visible on every case, so a priority can always be understood and, when necessary, challenged.
What it produces
- A priority for every case, with the factors behind it shown
- Suppression of deviations explained by approved change
- A queue a small security team can work through
Privilege at stake
Resource sensitivity
Attribution strength
Sequence severity
Corroboration
Change context
Operating principles
Security tooling should be held to the standard it enforces.
A platform that observes your most privileged automation must itself be narrow in what it can access and transparent in what it concludes.
Read-only integrations
Secrets stay where they are
Strict tenant isolation
Human-approved response
Explainable by construction
Works with your stack
Coverage
Deep where the risk is concentrated.
Ordrani covers the most privileged path in modern infrastructure — GitHub-driven automation operating in AWS — end to end, and is expanding to further environments.
Available now
AvailableGitHub-driven automation in AWS
- GitHub and AWS integrations
- Machine identity inventory and behavior models
- Workflow-to-cloud provenance
- AI-assisted investigations
- Identity relationship graph
- Blast-radius and sensitive-resource exposure
- Human-approved response workflows
- SIEM and ticketing export
Coming soon
Agents and additional environments
- AI agent runtime intelligence
- Kubernetes, Azure and Google Cloud
- Additional SaaS and developer platforms
See how the platform applies to your automation.
We are glad to walk through the architecture, discuss your CI/CD and cloud identity model, and explore whether Ordrani fits the problems your team is working on.