An integration account that can grant itself privileges

Integration can rewrite the security model.

A service account whose role can create roles, assign roles, or provision users can bootstrap itself to full control through the API alone. No production integration needs this.

Harder by hand, because the answer is inside the role rather than on it. Export the roles held by your application users and read their privilege lists for anything covering role creation, role assignment, user creation, or team write. In a large environment this is where the manual approach starts costing real time.

Remove the security-metadata write privileges; put any genuine user management behind human approval.

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

• A security role assigned to both people and integrations
• An integration account holding System Administrator
• A non-admin role that can grant itself administrator
• A role-holding team with both people and service accounts in it