Access mediation is a control pattern that sits between an identity and a target system to enforce policy, hide underlying credentials, and record the session. It is stronger than storage alone because it governs the access path, not just the secret, which makes revocation and auditing more reliable.
Expanded Definition
Access mediation is an intermediary control pattern for Non-Human Identity access that brokers a request before it reaches a target system. Rather than allowing a service account, API key, or agent to connect directly, the mediator enforces policy, can substitute or shield the underlying secret, and records what was requested and approved. That makes it different from simple secret storage, which protects credentials at rest but does not govern the live access path.
In NHI security, the term is used for gateways, brokers, session controllers, and privileged access layers that reduce direct-to-resource exposure. Definitions vary across vendors, especially where the mediator also performs authentication, authorization, session recording, or credential injection, so the operational boundary should be stated explicitly. NIST’s Zero Trust Architecture guidance is useful here because it treats every access request as policy-driven rather than trusted by network location or static possession of a secret.
The most common misapplication is calling any secrets vault “access mediation,” which occurs when the system stores credentials but does not intercept, authorize, or audit the actual access path.
Examples and Use Cases
Implementing access mediation rigorously often introduces latency and operational complexity, requiring organisations to weigh tighter control and auditability against higher integration overhead.
- A privileged session broker issues just-in-time access for production database maintenance, while recording the full session for review.
- An API gateway mediates service-to-service requests and blocks calls that violate policy, rather than exposing a shared long-lived token directly.
- A workflow engine mediates an AI agent’s access to cloud resources, ensuring the agent cannot reuse credentials outside the approved task window.
- An organisation with weak NHI governance uses the patterns described in the Ultimate Guide to NHIs to centralise access, then adds controls aligned to the OWASP Non-Human Identity Top 10 for policy enforcement and secret reduction.
- During third-party integration, access mediation limits what an external automation can reach, which is especially important when the relationship described in the 52 NHI Breaches Analysis shows how exposed service credentials are often abused.
Why It Matters in NHI Security
Access mediation matters because it changes the blast radius of a compromised identity. If a token, certificate, or service account is stolen, a mediated path can still enforce policy, narrow session scope, and preserve logs that support containment and forensics. That is critical in environments where NHIs outnumber human identities by 25x to 50x, as highlighted in NHI Mgmt Group’s Ultimate Guide to NHIs, because direct credential sprawl becomes unmanageable at scale.
It also supports governance when secrets are embedded in code, CI/CD pipelines, or third-party tooling. In those cases, mediation can be the practical control that makes revocation and audit effective even before deeper remediation is complete. The security failure mode is often not absence of a secret manager, but absence of an enforceable choke point around how credentials are used after issuance.
Organisations typically encounter the need for access mediation only after a service account abuse incident or unauthorized session, at which point mediation becomes operationally unavoidable to contain the breach.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST Zero Trust (SP 800-207) and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 | Covers mediated access patterns that limit direct secret exposure and improve auditability. |
| NIST Zero Trust (SP 800-207) | SA-1 | Zero Trust requires policy checks on each access request, matching mediation concepts. |
| NIST CSF 2.0 | PR.AC-4 | Least-privilege access control aligns with mediation that narrows and governs sessions. |
Broker NHI requests through a control point and log every mediated session for review.
