Orphans and Risk Scoring

An orphan is a record from a source system that AOH Sync could not match to any identity. The join keys found no home for it, so it sits unresolved. An orphan is unattributed access; the longer it persists, the more it matters.

Why orphans happen

• A new hire exists in payroll before their login account is created.
• A record uses a different identifier than the one AOH Sync matches on.
• An account genuinely belongs to no current person: a leftover, a mistake, or an unmarked service account.

The first two are timing or data problems. The third is real risk. Tracking orphans is how you tell them apart.

Risk scoring

Each orphan gets a risk score between 0.0 and 1.0. The score combines a baseline risk with how long the orphan has gone unresolved:

risk_score = base_risk + (days_orphaned * time_weight * base_risk)

capped at 1.0. Scores recompute on a regular cycle (about every 24 hours), so time acts as a risk multiplier: a brand-new orphan may be a harmless timing gap, but the same one unresolved a month later scores higher without anyone having to remember it.

Resolving an orphan

Status	Meaning
unresolved	No decision yet. Still accruing risk.
matched	Linked to an existing identity.
created_identity	A new identity was created from this record.
machine_identity	Identified as a non-human account; tracked as a machine identity.
dismissed	Reviewed and intentionally set aside.

AOH Sync surfaces match suggestions: the most likely existing identities for an orphan, ranked by confidence, so a person can confirm rather than search.

Why dismissed is a real outcome

Dismissing an orphan is a recorded decision, not a way to hide it. Someone looked, judged it not actionable, and that judgment is logged. That differs from an orphan no one ever reviewed: "we knew and decided" is never confused with "we never noticed."