A security administrator is reviewing an identity management program where accounts have been created inconsistently over the years — some service accounts are named 'svc_backup', others 'backupagent01', and still others 'jsmith-test'. This inconsistency makes it difficult to distinguish human accounts from service accounts during audits and to apply automated group policies. Which practice should the administrator implement to address this problem?