Identities

The Identities page in Ultra Hub lists every principal that has generated activity across your organization. An identity is the unit Ultra uses to attribute audit events, traces, and findings: a human user signed in through SSO, a service account, a device authenticated by a deploy key, or an unauthenticated MCP client whose traffic is grouped by its handshake principal. The list shows who used which MCP servers, which members are generating guardrail blocks, and what unattributed traffic is reaching your gateways. Audit log, traces, traffic, and server detail pages link to the identity detail page.

​

Attribution model

Ultra resolves the effective identity for every event using a three-tier fallback: The same dot-color convention appears wherever the IdentityLink component renders (audit log rows, trace drawers, traffic tables, server detail pages), so attribution is consistent across the entire dashboard.

​

The Identities list

Open Identities in the Hub sidebar to see every identity in your organization, sorted by most recently active by default.

​

Columns

​

Filtering

Click the filter icon to open the filter popover:

• Relationship: Member or Non-member.
• Assurance: Authenticated, Gateway-attributed, or No activity.
• Has anomalies: identities with at least one finding.
• Search: substring match against name and email (case-insensitive).

Filters compose with the column sort, so you can rank the riskiest unattributed traffic or the busiest members by tool-call volume.

​

Unattributed activity

The Unattributed Activity view (linked from the page header) lists traffic Ultra could not tie back to a Hub user. Entries are grouped by MCP client principal so you can spot:

• Shadow MCP clients running outside your managed gateway fleet.
• Misconfigured agents whose gateway owner has been removed or transferred.
• Service accounts that were never linked to a Hub identity.

Each group shows the principal, the gateways it reached, and the call volume. Use it as a punch list: each row should either be brought under management (assign a gateway owner, configure auth) or blocked via Governance if it shouldn’t be reaching Ultra at all.

​

Identity detail

Click any row to open the identity detail page. It pulls together the principal’s profile, recent activity, and security signals in a single view.

​

Header

The page header carries the identity name with its assurance dot, the member badge and role, and the first-seen / last-seen window.

​

Activity summary

A grid of six cards summarizes the identity’s last 30 days alongside a 90-day comparison:

• Tool calls: total tool-call count.
• Servers accessed: distinct upstream MCP servers reached.
• Unique tools: distinct tool names invoked.
• Active days: days with at least one event.
• Guardrail blocks: deny outcomes, with the all-time total alongside the 30-day window.
• Attribution split: how many events were authenticated vs. gateway-attributed. Hover the split for a tooltip explaining the layered model.

​

Peak hours heatmap

A 7×24 grid (day of week × hour, UTC) shading the times the identity is most active over the last 30 days.

​

Guardrail blocks by type

A breakdown of the identity’s denies grouped by guardrail, using the same guardrail names shown on the Guardrails catalog page (for example Parameter Validation, Credential Protection, or Tool & Server Isolation). Denies that cannot be mapped to a guardrail are bucketed under “unknown.”

​

Anomaly findings

Recent anomaly findings that named the identity. Each finding shows the risk level, score, recommended action, and a relative timestamp.

​

IdentityLink across the dashboard

Wherever Ultra surfaces a principal (audit log rows, trace drawers, traffic tables, server detail user lists), it renders the same IdentityLink component:

• Colored dot for assurance tier (green / amber / gray)
• Name (or email, or client principal as fallback)
• Role badge when the identity is a current member
• “Non-member” badge when the identity is outside the org

Clicking any IdentityLink opens the identity detail page in the same tab. Cmd/ctrl-click or middle-click opens the detail page in a new tab. This means every audit event or trace is one click away from the principal’s full profile.

​

Who can see Identities

Every Hub member with read access to the organization (owner, admin, member, and viewer roles) can view the Identities list, the detail pages, and the unattributed view. There is no separate permission for Identities. If a user can see the audit log, they can see who generated each event. Membership changes (a member leaves the org, a new owner is invited) are reflected on the next page load. Past activity remains attributed to the historical identity even after the user has been removed, so audit history is preserved.

​

Related