User presence is the physical confirmation that the legitimate user is actively approving a sensitive action, usually by touching the device. It is weaker than full verification on its own, but it helps prove that a real person is in control. For high-risk operations, it should be combined with additional checks.
Expanded Definition
User presence is a signal that a real person is physically interacting with a device at the moment a sensitive action is approved. In practice, it is often captured through touch, button press, or another local gesture that confirms immediate human involvement. It is narrower than full user verification, and it should not be treated as proof of identity by itself. Industry usage is still evolving because some platforms treat user presence as a lightweight anti-abuse control, while others use it as one factor in a broader authentication or authorization step.
Within NHI and agentic AI governance, the distinction matters because autonomous software can trigger actions, but user presence is intended to force a human checkpoint before a high-risk operation proceeds. That makes it useful for approving secret release, key rotation, vault access, or privileged workflow continuation. It aligns conceptually with the risk-based access logic described in NIST Cybersecurity Framework 2.0, but it is not a replacement for strong authentication, device trust, or policy enforcement. The most common misapplication is treating a single touch event as sufficient authorization for privileged NHI actions, which occurs when organisations confuse local physical interaction with verified user intent and identity assurance.
Examples and Use Cases
Implementing user presence rigorously often introduces workflow friction, requiring organisations to weigh fast approval paths against stronger resistance to unauthorized actions.
- A developer approves a one-time release of a production API key from a secure workstation, with the touch gesture acting as a local presence check before the secret is revealed.
- An operator confirms a break-glass session on a managed device, where presence is used to gate elevated access but still paired with logging and policy review.
- A CI/CD pipeline pauses for human presence before enabling a privileged deployment step, reducing the chance that an autonomous agent can silently expand its access.
- A security team uses presence checks for vault access during emergency remediation, then records the event alongside the guidance in Ultimate Guide to NHIs to keep the control tied to secret handling and lifecycle discipline.
- A phishing-resistant login flow requires local user presence on a trusted device, but the platform still validates the session against external policy and device posture.
These patterns are most effective when the presence signal is short-lived, locally bound to the device, and combined with a second factor or policy decision. For implementation context, teams often compare this control with device-bound authenticators described by NIST Cybersecurity Framework 2.0 and adjacent authentication guidance.
Why It Matters in NHI Security
User presence matters because many NHI incidents begin when a machine can act without a human checkpoint. That is especially dangerous for agents that can request secrets, approve deployment steps, or trigger privileged maintenance routines. In the Ultimate Guide to NHIs, NHIs are reported to outnumber human identities by 25x to 50x in modern enterprises, which means the operational surface for automated approval paths is far larger than many access teams expect. A weak presence signal can become a false sense of assurance if it is allowed to stand in for identity proofing, session binding, or authorization.
For governance, the practical question is whether a human truly had immediate control over the action, or whether an agent merely inherited a stale approval path. That distinction affects secret issuance, privileged escalation, incident containment, and audit defensibility. Organisations typically encounter the risk only after an unauthorized secret release, at which point user presence becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST SP 800-63, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | AAL2 | User presence is commonly used with authenticators discussed in digital identity assurance. |
| NIST CSF 2.0 | PR.AC | Presence checks support access control decisions but do not replace authorization policy. |
| NIST Zero Trust (SP 800-207) | SC-2 | Zero Trust assumes continuous verification beyond a one-time physical interaction. |
| OWASP Non-Human Identity Top 10 | NHI-06 | Human approval gaps can enable excessive privilege use by non-human identities. |
| OWASP Agentic AI Top 10 | AGENT-03 | Agentic systems need human-in-the-loop controls for sensitive tool use and escalation. |
Bind presence checks to least-privilege policies and verify every privileged action against access rules.
Related resources from NHI Mgmt Group
- How should security teams handle HOTP secret re-creation so user presence and user verification are both enforced?
- When do service accounts become a higher risk than ordinary user accounts?
- How should security teams govern infrastructure identities alongside user identities?
- What is the difference between managing user accounts and managing NHIs?
