Declared-vs-observed access is the comparison between what an agent is supposed to touch and what runtime evidence shows it actually touches. The gap matters because dormant permissions and hidden data paths often create more risk than the design documents suggest.
Expanded Definition
Declared-vs-observed access describes the difference between access that is approved on paper and access that is evidenced at runtime. In NHI security, the “declared” side usually comes from code, policy, architecture diagrams, IAM configuration, or service ownership records, while the “observed” side comes from logs, network traces, cloud audit events, secret usage telemetry, and agent tool calls. The term is especially useful where AI agents, service accounts, and API keys have broad entitlements but only use a smaller subset in practice.
This is not just a compliance check. It is a visibility discipline that helps teams find dormant permissions, hidden data paths, and tool misuse that static reviews miss. Industry usage is still evolving, but the operational goal is consistent: reduce the gap between intended access and actual behavior, then remove anything the runtime evidence cannot justify. Guidance from the OWASP Non-Human Identity Top 10 aligns with this approach by treating unnecessary NHI exposure as a security defect, not a documentation issue.
The most common misapplication is treating a permissions inventory as proof of real access, which occurs when teams assume granted entitlements are actively used without checking runtime evidence.
Examples and Use Cases
Implementing declared-vs-observed access rigorously often introduces monitoring overhead and review effort, requiring organisations to weigh stronger least-privilege decisions against the cost of collecting trustworthy evidence.
- A CI/CD service account is declared to deploy only to one production cluster, but audit logs show it also reads secret material from a staging vault.
- An AI agent is authorised to query a ticketing system, yet runtime traces reveal it also invokes a file storage tool and copies attachments into a separate workflow.
- A cloud workload is documented as using a single API scope, but the Ultimate Guide to NHIs highlights how hidden secret sprawl and weak visibility often make these assumptions unreliable.
- A security team compares declared entitlements with observed network destinations to identify service accounts reaching internal systems they were never intended to touch.
- Framework guidance such as NIST SP 800-53 Rev 5 Security and Privacy Controls supports this work through access control and monitoring controls that can be validated against real activity.
Why It Matters in NHI Security
Declared-vs-observed access matters because NHI environments often accumulate permissions faster than they are retired. NHIMG notes that 97% of NHIs carry excessive privileges, which makes entitlement drift a routine condition rather than an edge case. If organisations only review declared access, they may miss a compromised token quietly using a path that was never intended, or a benign agent overreaching into sensitive systems because the design was never tightened after deployment.
This concept is also central to incident response and governance. The 52 NHI Breaches Analysis shows how often weak NHI control surfaces appear in real incidents, while Ultimate Guide to NHIs — Key Challenges and Risks connects that exposure to visibility gaps, rotation failures, and poor offboarding discipline. Organisations typically encounter declared-vs-observed gaps only after an incident review or failed audit reveals that runtime access exceeded the approved design, at which point the term becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Declared vs observed access exposes NHI privilege drift and excessive runtime reach. |
| NIST CSF 2.0 | DE.CM-1 | Continuous monitoring is needed to compare approved access with actual activity. |
| NIST SP 800-53 Rev 5 | AU-6 | Audit review and analysis supports detecting access that differs from the declared model. |
| NIST Zero Trust (SP 800-207) | AC-4 | Zero trust policy enforcement depends on validating actual access paths, not assumed ones. |
| OWASP Agentic AI Top 10 | AGENT-04 | Agent tool use must be bounded by least privilege and observable execution paths. |
Instrument NHI logs and alerts so observed behavior can be reconciled with declared entitlements.
