Rhindon Cyber logo
    Support & Documentation
    Contact Support

    Infrastructure Hygiene

    Infrastructure Hygiene measures and enforces the operational health of the identity, entitlement, data-classification, and review surfaces that AI Systems depend on. It is available on Professional and Enterprise tiers when the Super Admin enables the per-tenant infrastructure_hygiene feature flag. Enterprise tenants additionally unlock entitlement overage scoring (F2), continuous NHI reviews (F5), and the Infrastructure Hygiene Score (IHS) gate at S6 Production Approval (F6).

    Module surface

    The module lives at /governance/hygiene and exposes five tabs:

    • NHIs (Pro + Enterprise) — Non-Human Identity registry sourced from Microsoft Graph (service principals, managed identities, app registrations) with a manual CSV escape hatch for non-Microsoft tenants.
    • Entitlements (Enterprise only) — daily ingest of Microsoft Graph appRoleAssignments + oauth2PermissionGrants + sign-in activity. Computes the gap between granted and actually-used permissions per NHI (90-day staleness window), bucketed into 5 risk bands (none / low / moderate / high / critical). Nightly cron (08:15 UTC) writes per-NHI snapshots; manual recompute available from the tab. Powers the Privilege dimension of the IHS.
    • Data (Pro + Enterprise) — Microsoft Purview sensitivity labels per resource (SharePoint sites/drives/files) with a manual CSV escape hatch for non-Microsoft tenants. Labels are normalized into a 5-tier bucket (Sensitive, Confidential, Internal, Public, Unclassified) and rolled up per AI System using highest-tier inheritance. Nightly cron (08:30 UTC) refreshes labels; manual "Ingest via Graph" available from the tab. Powers the Data Classification dimension of the IHS.
    • Shadow AI (Pro + Enterprise) — heuristic correlation between the AI Discovery feed and the NHI registry, flagging "Likely Service Account" usage.
    • Reviews (Enterprise only) — cadence-driven owner attestation campaigns. OrgAdmin/WorkflowAdmin launches a campaign (scope: all promoted or overdue only); one row per NHI is created and owners attest still_used / decommission / change_owner. Daily cron /api/public/cron/nhi-review-campaign-due opens scheduled campaigns at 08:15 UTC and emails owners via notifyNhiReviewOwners. Audit codes: HYGIENE_REVIEW_CAMPAIGN_LAUNCHED,HYGIENE_REVIEW_ATTESTATION_SUBMITTED.

    The IHS gate (Enterprise)

    The Infrastructure Hygiene Score (IHS) is a 0–100 composite built from five weighted dimensions: Identity Coverage (25), Privilege Hygiene (25), Data Classification (20), Dormant Credentials (15), and Review Currency (15). It is computed per AI System and evaluated at Stage 6 — Production Approval on the harmonized AI Systems workflow.

    The gate has two modes, configured per organization in app_settings underhygiene_gate_mode:

    • warn (default on enable) — S6 shows a red banner with the score breakdown but the approver can proceed. HYGIENE_IHS_GATE_BLOCKED is still emitted for traceability.
    • block — S6 is hard-blocked when IHS is below the configured threshold. An OrgAdmin sees a one-time override button; using it requires a justification of at least 20 characters and emitsHYGIENE_GATE_OVERRIDDEN with the reason captured both verbatim and as structured metadata. Every override is bundled into the Recertification Pack asRhindonCyber_HygieneGateOverrides.csv so auditors see the bypass evidence in one file.

    Auto-promote: 30 days after the module is first enabled, a daily cron flips the mode from warn to block exactly once and emitsHYGIENE_GATE_MODE_CHANGED with actor=System. OrgAdmins may flip it back to warn at any time; auto-promote does not re-fire.

    Audit codes (19, locked roster)

    All 19 codes for the module are registered up-front in the infrastructure_hygiene family (see iso42001CodeFamilies). Codes stay inert until the capability that writes them is enabled, and the family-drift test enforces the roster.

    • NHI Registry (7): HYGIENE_NHI_DISCOVERED, _PROMOTED, _DISMISSED, _OWNER_ASSIGNED, _REVIEWED, _REVIEW_OVERDUE, HYGIENE_CSV_INGESTED
    • Entitlements (2): HYGIENE_ENTITLEMENT_INGESTED, HYGIENE_OVERAGE_CALCULATED
    • Data Classification (1): HYGIENE_DATA_CLASSIFICATION_INGESTED
    • Shadow AI (2): HYGIENE_SHADOW_AI_CORRELATED, HYGIENE_SHADOW_AI_DISMISSED
    • Reviews (2): HYGIENE_REVIEW_CAMPAIGN_LAUNCHED, HYGIENE_REVIEW_ATTESTATION_SUBMITTED
    • IHS & Gate (5): HYGIENE_IHS_COMPUTED, HYGIENE_IHS_GATE_BLOCKED, HYGIENE_GATE_OVERRIDDEN, HYGIENE_GATE_MODE_CHANGED, HYGIENE_PACK_EXPORTED

    v1 scope notes

    v1 ships with Microsoft Entra + Microsoft Purview only. The manual CSV upload (built on the canonical bulk-CSV importer) is the non-Microsoft escape hatch until the credential store is extended for AWS / GCP in v2.

    Capabilities become available in this order: NHI Registry → Entitlements → Data Classification → Shadow AI → Reviews → IHS Gate & Client Pack.

    Where to find it

    Once a Super Admin enables the infrastructure_hygiene flag for your tenant on the Feature Flags page, the module appears at /governance/hygiene. A Docs button on the page links back here.