The identity that first triggered an action, rather than the last system that executed it. In production environments, this may be a human user, service account, workload, third party, or AI process. It is the key reference point for attribution, investigation, and governance.
Expanded Definition
Originating identity is the first actor or credential that initiated a transaction, even when later hops, brokers, proxies, or runtime components execute the request. In NHI security, that distinction matters because attribution, trust decisions, and forensic reconstruction depend on the source of action, not merely the last authenticated system. This is especially important in chained workflows involving service accounts, workload identities, API keys, agentic systems, and third-party integrations. Industry usage is still evolving, so some vendors blur originating identity with caller identity, effective identity, or execution identity; those are related but not interchangeable concepts. For governance, teams should preserve originating identity through propagation, logging, and policy evaluation, then compare it with the identity that actually performed the execution. The NIST Cybersecurity Framework 2.0 provides a useful governance anchor for identity-aware tracing and accountability in security operations, especially when paired with NIST Cybersecurity Framework 2.0. The most common misapplication is treating the final service account as the source of truth, which occurs when distributed systems overwrite the original actor during delegation or token exchange.
Examples and Use Cases
Implementing originating identity rigorously often introduces traceability overhead, requiring organisations to weigh cleaner attribution against added propagation and logging complexity.
- A user triggers an AI assistant that calls multiple APIs; the originating identity remains the human requester, not the agent runtime or downstream tool credentials.
- A CI/CD pipeline assumes a deployment role to publish artifacts; the originating identity is the developer or change process that initiated the pipeline, as described in the Ultimate Guide to NHIs.
- A third-party SaaS integration forwards requests through a proxy; the proxy may be the executor, but the originating identity is the external tenant or application that first submitted the action.
- An internal microservice exchanges tokens to call another service; investigators use originating identity to determine whether the chain began with a legitimate workload or a compromised secret, a pattern reflected in 52 NHI Breaches Analysis.
- A security team correlates session logs, token issuance, and policy decisions to preserve the original actor across service hops, which aligns with identity-centric monitoring guidance in NIST Cybersecurity Framework 2.0.
Why It Matters in NHI Security
When originating identity is lost, investigations become noisy and governance breaks down: alerts point to the executor, but the risk may belong to the first credential that was stolen, over-privileged, or misused. That gap is especially dangerous in NHI environments where a single API key, service account, or AI agent can trigger a long chain of downstream actions. NHIMG research shows that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, which makes source attribution a practical control objective rather than a documentation exercise, as detailed in the Ultimate Guide to NHIs. It also helps explain why strong identity governance must include provenance, not just authentication at the point of execution. A useful operational pattern is to pair originating identity with logs, token lineage, and access policy decisions so responders can reconstruct the true attack path. As identity chains grow through orchestration, Top 10 NHI Issues highlights how missing provenance becomes a recurring failure mode. Organisations typically encounter attribution failure only after a breach investigation stalls, at which point originating identity becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Originating identity underpins traceability and attribution for NHI actions. |
| NIST CSF 2.0 | DE.CM-8 | Identity and asset monitoring supports tracing the true source of activity. |
| NIST Zero Trust (SP 800-207) | PA-7 | Zero Trust decisions depend on continuous identity provenance, not just execution context. |
| NIST SP 800-63 | Identity assurance concepts help distinguish the original authenticator from delegated execution. | |
| OWASP Agentic AI Top 10 | A2 | Agent workflows must preserve the initiating actor across tool use and delegation. |
Preserve source identity across hops so every NHI action can be attributed to the initiating actor.
