> For the complete documentation index, see [llms.txt](https://docs.aohwv.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aohwv.dev/core-concepts/orphans.md).

# Orphans and Risk Scoring

An **orphan** is a record from a source system that AOH Sync could not match to any identity. The [join keys](/core-concepts/the-identity-graph.md) found no home for it, so it sits unresolved. An orphan is unattributed access; the longer it persists, the more it matters.

## Why orphans happen

* A new hire exists in payroll before their login account is created.
* A record uses a different identifier than the one AOH Sync matches on.
* An account genuinely belongs to no current person: a leftover, a mistake, or an unmarked service account.

The first two are timing or data problems. The third is real risk. Tracking orphans is how you tell them apart.

## Risk scoring

Each orphan gets a **risk score** between 0.0 and 1.0. The score combines a baseline risk with how long the orphan has gone unresolved:

```
risk_score = base_risk + (days_orphaned * time_weight * base_risk)
```

capped at 1.0. Scores recompute on a regular cycle (about every 24 hours), so time acts as a risk multiplier: a brand-new orphan may be a harmless timing gap, but the same one unresolved a month later scores higher without anyone having to remember it.

## Resolving an orphan

| Status             | Meaning                                                                                                   |
| ------------------ | --------------------------------------------------------------------------------------------------------- |
| `unresolved`       | No decision yet. Still accruing risk.                                                                     |
| `matched`          | Linked to an existing identity.                                                                           |
| `created_identity` | A new identity was created from this record.                                                              |
| `machine_identity` | Identified as a non-human account; tracked as a [machine identity](/core-concepts/machine-identities.md). |
| `dismissed`        | Reviewed and intentionally set aside.                                                                     |

AOH Sync surfaces match suggestions: the most likely existing identities for an orphan, ranked by confidence, so a person can confirm rather than search.

## Why dismissed is a real outcome

Dismissing an orphan is a recorded decision, not a way to hide it. Someone looked, judged it not actionable, and that judgment is logged. That differs from an orphan no one ever reviewed: "we knew and decided" is never confused with "we never noticed."


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.aohwv.dev/core-concepts/orphans.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.