One person. Every account.
Subimage ties one person to their Okta login, Entra account, GitHub handle, IAM user, Slack member and Jamf laptop, with title and manager from Workday. Ask what a contractor can reach and get one answer for the person, not six for the accounts.
Every hop, from IdP to resource
CIEM tools tell you what a role can do. Subimage shows who can become that role and what they reach next.
- Okta group → AWS Identity Center permission set → IAM role → prod S3 bucket
- Entra group → AWS Identity Center → AdministratorAccess in the payments account
- GitHub repo → Actions OIDC trust → IAM role that deploys to prod
Non-human identities don't get a pass
Non-human identity management on the same graph as your people. IAM roles, GCP service accounts, Entra service principals, Kubernetes service accounts and API keys get the same effective-access math, plus the workload that runs as each one and the team that owns it.
- Lambda functions and EC2 instances whose roles can create IAM users or rewrite policies, ranked higher when they face the internet
- API keys with their last use and expiry, Databricks tokens that never expire and AWS keys not rotated in 90 days
Who can make themselves admin
- AWS, GCP, Azure and Scaleway principals that can create identities, write policies or hand out roles
- Principals that can rewrite a role's trust policy to let another account in
- GCP principals that can impersonate any service account or mint long-lived keys for one
The access nobody took back
- Accounts that don't map to any person
- AWS access keys unused for 45 days or more
Works with the identity stack you run, whatever it is
Okta, Entra, Google Workspace, JumpCloud, Duo, Keycloak, WorkOS and LastPass on the identity side. AWS, GCP, Azure and Scaleway IAM, GitHub, GitLab, Kubernetes, Snowflake and Databricks on the resource side. Workday and Jamf fill in the person and the laptop.
- Running something we don't cover yet? We add new integrations fast.
- Bring your own data with Declarative Schema: an in-house IdP, an HR export or a homegrown permissions table maps into the same graph as everything else.