A learned model of how every machine identity behaves.

Permissions describe what an identity is allowed to do. They say nothing about what it normally does. A deployment role may hold the right to read every secret in an account and never once use it — until the day its credentials are used by someone else.

Ordrani maintains a behavior model for every monitored machine identity. Each model is learned from that identity’s own history: when it runs, which APIs it calls and in what order, which resources it touches, which permissions it actually exercises and which identities it works alongside.

Because a pipeline or service account tends to repeat the same work on the same schedule, departures from that routine carry real information. The difficulty is precision — telling a misused credential apart from a legitimate release. The models are designed around that distinction.