If your programme can certify access but cannot explain which workload, API, or agent executed a transaction, the model is still user-centric. A modern governance stack should connect identity, entitlement and runtime evidence.
Why User-Centric Governance Misses the Real Control Surface
Identity governance is still too user-centric when it proves who approved access, but not which workload, API, or agent actually exercised that access. That gap matters because modern environments rarely execute meaningful transactions through a human session alone. The control problem shifts from “who is the person?” to “what non-human actor acted, under what authority, and with what runtime evidence?” NHIMG’s 2026 Infrastructure Identity Survey found that 67% of organisations still rely heavily on static credentials, which is a strong signal that governance has not yet moved to the execution layer.
The 2026 Infrastructure Identity Survey shows why this matters for teams trying to govern agentic systems, cloud services, and automation pipelines. Certification without runtime attribution can look compliant while leaving the actual actor invisible. In practice, many teams discover that their access reviews were complete long before anyone could explain which non-human identity made the change.
How to Tell the Model Is Still Centred on People, Not Workloads
In practice, user-centric governance shows up as a set of mismatched artefacts. Access reviews are tied to employee names, service accounts are treated as exceptions, and API keys or agent tokens are managed as ad hoc secrets rather than governed identities. If the organisation can answer “who has access?” but not “which workload used it, where, and for how long?”, the programme is still operating at the human layer.
The practical test is whether identity, entitlement, and runtime evidence are linked. A modern model should be able to connect an approval to a workload identity, a scope of privilege, and observable activity in logs or telemetry. That is especially important where access is short-lived or delegated through automation, because the human approver is not the actor that creates the operational risk.
- Look for governance processes that inventory users first and non-human identities second, if at all.
- Check whether service accounts, tokens, certificates, and agent credentials are reviewed with the same rigor as employee access.
- Verify whether runtime logs identify the workload or agent, not just the human owner.
- Confirm that privilege changes are bounded by workload context, environment, and expiry, not only by role title.
Current guidance from identity and security practice is evolving toward workload-centric evidence, because static role assignments do not explain autonomous behaviour or delegated execution. Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs is useful here because lifecycle control becomes the bridge between inventory, ownership, rotation, and revocation.
These controls tend to break down when service-to-service trust is inherited across many systems, because the original approver loses visibility into the actual runtime path.
Signals, Edge Cases, and the Transition to Non-Human Governance
Tighter governance often increases operational overhead, so organisations have to balance review burden against the need for credible runtime attribution. The strongest signal of maturity is not that every identity is human-readable, but that every meaningful action can be traced to a governed non-human principal with a bounded scope.
There are a few edge cases where user-centric language persists even in fairly mature programmes. Some teams still anchor all ownership in a human sponsor for accountability, which is fine, but only if the workload itself has a distinct identity and policy boundary. Others keep agent permissions inside broad application roles, which is convenient until a single agent begins acting across multiple systems. Best practice is evolving, but there is no universal standard yet for how much agent autonomy can be governed purely through human access models.
Top 10 NHI Issues is a good reference point when a team wants to compare its current controls against common non-human identity failures. The key question is whether governance can distinguish ownership from execution. If it cannot, the programme is still describing people while the environment is being operated by machines.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Inventory and Ownership | User-centric governance misses workload identity inventory and ownership. |
| NHI-02 — Authentication and Secrets | Static credentials and tokens are central to the user-centric gap. | |
| NHI-04 — Monitoring and Detection | Runtime attribution is needed to see which non-human actor executed actions. | |
| Recommendation — Inventory workloads, service accounts, and agent identities before certifying access. Replace long-lived shared credentials with managed, short-lived identity material. Correlate identity events with runtime telemetry to attribute non-human activity. | ||
| OWASP Agentic AI Top 10 | A2 — Agent Identity and Access Control | Agentic systems expose the limits of human-only governance models. |
| A6 — Secrets and Credential Management | Agent tokens and static credentials are a key sign of user-centric governance. | |
| Recommendation — Bind agent permissions to explicit workload identity and context-aware access rules. Issue ephemeral credentials for agents and revoke shared secrets on a fixed cadence. | ||
| CIS Controls v8 | 5 — Account Management | Non-human identities need distinct lifecycle control, not user-only certification. |
| 6 — Access Control Management | The question is about whether entitlement decisions reflect real actors and scope. | |
| Recommendation — Separate service and workload accounts from user accounts and review them independently. Enforce least privilege for non-human principals and remove unnecessary access paths. | ||
| NIST CSF 2.0 | PR.AC — Access Control | The issue concerns whether access governance matches actual actors and permissions. |
| Recommendation — Map every meaningful transaction to a controlled identity and approved privilege scope. | ||
Practitioner Guidance
What to verify: Check whether every high-impact workload, API key, token, certificate, and agent has a distinct governable identity and an owner, rather than being folded into a human user record.
Decision rule: If an access review cannot show who or what executed the action at runtime, treat the control as incomplete even if the approval workflow was clean.
What practitioners underestimate: The biggest failure is often not missing approval, but missing attribution. Without runtime evidence, it is hard to scope blast radius, rotate the right secret, or prove whether the actor was a person, service, or agent.
Practitioner takeaway: The shift away from user-centric governance is complete only when entitlement decisions and runtime telemetry describe the same actor; otherwise the programme is certifying people while machines remain effectively ungoverned.
