A person pool is a shared identity container that lets the same human be recognised across multiple organizations or suborganizations. It supports consistent user identity when a person belongs to more than one tenant. The model is useful when applications need cross-org continuity without losing control over tenant-level access boundaries.
Expanded Definition
A person pool is a shared identity pattern used when the same human must be recognised across multiple organizations, suborganizations, or business units without forcing a separate identity record for every context. In practice, it sits between a purely tenant-local account and a fully global identity, preserving continuity for the person while still allowing each tenant to enforce its own access rules, approvals, and data boundaries.
In NHI and IAM discussions, the term is most useful when an application must support cross-org collaboration, mergers, joint ventures, delegated administration, or workforce populations that move between operating units. The key distinction is that a person pool is about identity continuity, not broad access inheritance. It helps systems resolve “this is the same person” while leaving authorisation decisions to the receiving organization. Definitions vary across vendors on whether the pool is a directory construct, a federation pattern, or an application-layer abstraction, so implementation details should be checked carefully.
The most common misapplication is treating the person pool as a shortcut to share permissions across tenants, which occurs when identity matching is confused with entitlement reuse.
Examples and Use Cases
Implementing a person pool rigorously often introduces identity reconciliation overhead, requiring organisations to weigh cross-org continuity against tighter tenant separation and governance complexity.
- A contractor works for two subsidiaries and needs one consistent identity record while each subsidiary maintains separate approval workflows.
- An enterprise acquiring another company wants to preserve user continuity during migration without immediately merging all directories.
- A platform serving partner organizations uses a pooled person record to link the same human to different tenant-specific roles and entitlements.
- A joint-venture environment needs shared recognition for audit and reporting, but each participant still controls local access decisions.
- A workforce portal correlates a returning employee with prior identity proofing data while still issuing fresh tenant-specific authorisation.
For broader context on why identity sprawl matters in modern environments, see the Ultimate Guide to NHIs and the NIST Cybersecurity Framework 2.0. A person pool is especially useful when onboarding must preserve continuity across organizational boundaries without collapsing access models into a single shared tenant.
Why It Matters in NHI Security
Person pools matter because identity correlation is often the first place governance breaks down when humans, service workflows, and delegated access models overlap. If the same person appears in multiple contexts without a controlled matching strategy, organisations can create duplicate accounts, miss toxic access combinations, or lose the ability to trace actions back to a single accountable identity. That risk becomes sharper in NHI-heavy environments, where human identity data is often used to approve, recover, or govern access for non-human identities.
NHIMG reports that 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, which is relevant here because cross-tenant identity continuity must not weaken boundary enforcement. A person pool should therefore support traceability, least privilege, and clean offboarding across every tenant where the person is recognised. It also needs strong identity proofing and reconciliation logic so that a matching record does not become an unintended access bridge.
Organisations typically encounter the consequences of a poorly designed person pool only after a merger, access review failure, or incident investigation, at which point the concept becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-1 | Identity proofing and access control must distinguish the person across tenant contexts. |
| NIST Zero Trust (SP 800-207) | Zero Trust requires continuous trust evaluation across organizational boundaries. | |
| NIST SP 800-63 | IAL2 | Person pools depend on identity resolution that is consistent with assurance and proofing. |
| OWASP Non-Human Identity Top 10 | NHI-01 | Identity boundary mistakes can expose NHI governance when humans and non-humans intersect. |
| CSA MAESTRO | Agentic workflows rely on clear human identity attribution for delegated control and audit. |
Preserve accountable human linkage so delegated agent actions remain traceable to the right person.
Related resources from NHI Mgmt Group
- Why do online identity verification workflows create more governance pressure than in-person checks?
- Why do non-person entities need the same lifecycle discipline as user identities?
- What breaks when one person can create and approve the same financial transaction?
- Why do non-person entities need separate IAM governance?
