Because service accounts, API keys, and certificates carry real access and real risk, but they rarely fit human-centric governance assumptions. If an IGA programme cannot inventory and review those identities, it leaves a large part of the attack surface outside lifecycle control and compliance evidence.