User-centric security control is a model that follows the user across devices, browsers, and applications instead of depending on one locked-down platform. It aims to preserve productivity while enforcing policy wherever work happens. This approach is especially relevant when employees adopt new AI tools faster than formal security standardisation.
Expanded Definition
User-centric security control is a policy model that follows the user’s identity and risk context across devices, browsers, applications, and AI-enabled workflows rather than binding protection to a single managed endpoint. In NHI and IAM programmes, that means the control plane is anchored to authentication state, device posture, session signals, and authorization context, not to one locked-down platform. This matters because work now moves between SaaS apps, browser sessions, mobile devices, and autonomous tools, so security must remain consistent as the user context shifts. The term is often used alongside zero trust and adaptive access, but definitions vary across vendors and no single standard governs this yet. NIST’s NIST Cybersecurity Framework 2.0 is a useful anchor for understanding how identity, access, and monitoring controls can stay continuous across changing environments. The most common misapplication is treating device management as the same thing as user-centric security, which occurs when organisations assume a compliant laptop automatically means a trustworthy session.
Examples and Use Cases
Implementing user-centric security control rigorously often introduces policy complexity, requiring organisations to weigh consistent enforcement against user friction and administrative overhead.
- Conditional access allows a finance analyst to reach payroll data from a personal tablet only when the session passes step-up authentication and risk scoring.
- A browser-based work app enforces the same data-loss rules whether the user signs in from a corporate laptop, a contractor device, or a virtual desktop.
- Access to an AI coding assistant is allowed only for approved users, with restrictions that follow the user into the tool rather than relying on local endpoint controls.
- Privileged actions in a SaaS admin console require reauthentication when the session shifts to an unfamiliar network or an unmanaged device.
- Identity governance ties access reviews to the person and their active entitlements, not to the platform where the entitlement happens to be used.
The security value becomes clearer when paired with NHI visibility and secret hygiene guidance from Ultimate Guide to NHIs — Standards. For browser- and tool-centric workflows, teams also look to NIST Cybersecurity Framework 2.0 to align identity, detection, and response across distributed access paths.
Why It Matters in NHI Security
User-centric security control is important in NHI environments because human access and non-human access increasingly overlap inside the same workflows. A person may approve an AI action, launch a workflow, or delegate access to a service account that then persists beyond the original session. If control logic is tied only to the endpoint, administrators lose visibility into where authority actually travels. That creates gaps in policy enforcement, logging, and revocation, especially when users move between managed and unmanaged environments. NHIMG research shows that only 1.5 out of 10 organisations are highly confident in securing NHIs, and the confidence gap is amplified when access decisions are fragmented across devices and tools. The Ultimate Guide to NHIs — Standards also highlights how excessive privileges and poor secret handling can persist when identity controls are not tied to active context. In practice, user-centric controls support the same governance outcome as zero trust: decisions should be made per session, per action, and per risk signal. Organisations typically encounter the need for this control only after a compromised session, delegated token, or rogue AI action bypasses a device-only safeguard, at which point user-centric enforcement becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA | Identity and access assurance underpin user-centric control across changing contexts. |
| NIST Zero Trust (SP 800-207) | PDP/PAP | Zero trust evaluates each request dynamically instead of trusting a device boundary. |
| NIST SP 800-63 | AAL2 | Authenticator assurance levels support stronger, context-aware user verification. |
| OWASP Agentic AI Top 10 | LLM-01 | Agentic workflows extend user authority into tools and need guardrails. |
| OWASP Non-Human Identity Top 10 | NHI-02 | User-centric access often exposes secrets and tokens used by non-human workloads. |
Bind access decisions to user identity, session risk, and continuous verification signals.
Related resources from NHI Mgmt Group
- How should security teams automate user access reviews without losing control quality?
- How should security teams automate user provisioning without losing control?
- How should security teams reduce user access review fatigue without weakening control?
- How should security teams govern privileged access in user-centric ZTNA environments?
