Users are trust anchors
A user listing should quickly separate known identity, weak identity, and high-consequence ownership lanes.
That is more useful than a directory sorted by email.
QS
Users Meaning Layer
User inventory should answer who can be trusted, who is unresolved, and whose work has the highest company consequence before it behaves like a directory.
Operator Brief
2 identities deserve focus
One unresolved identity weakens trust while one highly active developer anchors several important sessions.
Question This View Answers
Which people matter most to the current security picture?
High-signal users
2
1 unresolved, 1 high-consequence known user
Known identities
11
Most users are stable and attributable
Sensitive repo owners
3
A small group carries most company consequence
Background identities
9
Useful context, not first-read material
c6 List Reference
Users observed
12
Unknown identities
1
Trust gap
Top user
alice@company.com
Primary lane
Claude Code
Why Borrow This Shape
Raw User Inventory
Identity, role, sessions, spend, and primary tools.
| User | Role | Sessions | Total cost | Primary agent |
|---|---|---|---|---|
| alice@company.com | engineer | 6 | $2.41 | Claude Code |
| unknown | unmapped | 1 | $0.61 | Claude Code |
| ci-runner-04 | automation | 11 | $0.82 | LangChain |
Why Users Matter
A known person can still matter a lot
Meaning-first user pages should surface the people whose work explains the current story even when nothing looks obviously wrong.
Significance is not only about anomalies.
User detail should explain accountability
The page should show what this person anchors and what remains shared around them.
That is how security moves from observation to action.
Priority Queue
alice@company.com
Stable identity linked to the most consequential recent developer work.
Why It Matters
A trusted actor can still anchor the most important story.
Unknown identity chain
One unattributed lane weakens confidence elsewhere.
Why It Matters
This is the fastest user-side trust gap to close.
CI automation account
High volume but low consequence baseline.
Why It Matters
Useful contrast against human-operated sessions.
Users Relationship Map
User trust map
The user story should connect person, endpoint, agent, and company context into one accountability view.
A meaning-layer user page is about anchored interpretation, not only account metadata.
Identity, adjacency, activity, and posture around one representative item.
Identity chain
What makes the user trustworthy?
alice@company.comorg identity
acct_01AbcXyz...provider account
Execution lane
How does the user work?
Claude Codeprimary lane
alice-mbp.localstable host
user
alice@company.com
Stable developer identity tied to the most meaningful recent work.
trusted anchor
Company context
What does the user touch?
api-refactorauth repo path
.env + config filessensitive context
Shared infrastructure
What complicates the story?
shared org keycaveat
provider trafficexpected but relevant
identity strength
high
company consequence
high
shared caveat
1
next drill
session detail
Representative Entity
alice@company.com
Raw Evidence Paths
Representative Raw Detail
Inspect the canonical entity page after the meaning layer narrows focus.
Open raw detail