Managing application choice means setting policy, approval, and oversight around which tools can be used and how they are secured. Allowing unrestricted use gives business users full freedom without governance guardrails. The first approach supports visibility and risk reduction. The second increases the chance of shadow IT, inconsistent access control, and data exposure.
Why This Matters for Security Teams
Managing application choice is a governance decision: security and platform teams define which applications are approved, what data they can touch, and what controls must exist before use. Allowing unrestricted application use removes those guardrails, which usually leads to shadow IT, inconsistent review, and unclear accountability. That difference matters most when applications exchange secrets, API keys, or service tokens across business systems.
NHIMG research shows why this becomes a security issue quickly: 96% of organisations store secrets outside of secrets managers in vulnerable locations, and only 5.7% have full visibility into service accounts. In practice, unrestricted app use makes that visibility problem worse because each new tool can create another identity, another secret, and another access path. Guidance in the Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs and the NIST Cybersecurity Framework 2.0 both point toward controlled inventory, review, and access discipline rather than open-ended sprawl.
In practice, many security teams encounter risky application use only after a business unit has already onboarded a tool, shared secrets, and exposed data outside approved governance.
How It Works in Practice
Application choice management works best as a lifecycle control, not a one-time approval. Security teams define categories of allowed software, evaluate data handling and vendor risk, and require controls such as SSO, logging, data retention review, and secrets protection before deployment. The goal is not to block all new tools, but to make tool adoption observable and defensible. That aligns with NHI governance because many applications create or consume non-human identities behind the scenes.
A practical model usually includes:
- an approved application catalog with business owners and risk tiers;
- review gates for data access, integrations, and third-party sharing;
- secret handling rules for API keys, tokens, and certificates;
- periodic recertification to remove unused or high-risk applications;
- offboarding steps that revoke access when a tool is retired.
The difference from unrestricted use is that each application must earn access and remain in policy, rather than being assumed safe by default. The Top 10 NHI Issues highlights how easily identity sprawl and secret leakage grow when controls are inconsistent. For operational context, NIST CSF 2.0 encourages continuous governance and oversight, not just perimeter approval. Current guidance suggests pairing application approval with workflow-based reviews so that business speed does not come at the cost of unmanaged access.
These controls tend to break down when departments can install cloud apps or browser extensions without central review because the security team loses both inventory and enforcement before any risk assessment occurs.
Common Variations and Edge Cases
Tighter application approval often increases friction for business teams, so organisations must balance agility against the cost of unmanaged risk. That tradeoff is real, especially in SaaS-heavy environments where users adopt tools quickly to meet deadlines. Current guidance suggests risk-based tiers rather than a single approval standard for every app.
Some teams allow broad use of low-risk productivity tools but restrict anything that handles customer data, code, credentials, or privileged integrations. Others apply conditional approval: an application is permitted only if it uses enterprise authentication, supports audit logs, and passes a security review. There is no universal standard for this yet, but the pattern is consistent: unrestricted use works only when the application has no meaningful access to sensitive systems, which is rare.
Edge cases include personal productivity apps, browser plugins, and AI-powered tools that can ingest documents or connect to external services. Those tools often appear harmless until they start moving data, storing tokens, or connecting to internal systems. The Ultimate Guide to NHIs — Regulatory and Audit Perspectives is useful here because auditors typically care less about brand category and more about whether access was approved, reviewed, and revoked when no longer needed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-1 | Covers identity and access management for approved application use. |
| OWASP Non-Human Identity Top 10 | NHI-01 | Application sprawl creates unmanaged non-human identities and secrets. |
| NIST AI RMF | GOVERN | Governance is needed when apps ingest data or trigger automated decisions. |
| NIST Zero Trust (SP 800-207) | PL-1 | Restricted app use aligns with continuous verification and least privilege. |
| CSA MAESTRO | GOV-01 | Helps govern application and agent access in multi-system environments. |
Set ownership, approval, and oversight for any application that affects sensitive workflows.
Related resources from NHI Mgmt Group
- What is the difference between managing human accounts and non-human identities?
- What is the difference between application mapping and application merging in SaaS governance?
- What is the difference between enforcing authorization in the application and enforcing it through database filters?
- What is the difference between attack surface management and NHI governance?
