A governance approach that evaluates whether an identity still deserves its current authority while it is active, rather than only at fixed review points. For agentic AI, it extends access certification into runtime by considering task context, delegated tools, and live behaviour, not just the original approval record.
Expanded Definition
continuous certification of Trust is the practice of re-evaluating whether an identity, workload, or agent should retain authority while it is still active. In NHI and agentic AI environments, that means access is not treated as permanently valid after approval; instead, trust is repeatedly tested against current context, observed behaviour, delegated scope, and task necessity. This is closely related to Zero Trust thinking, but it is more operational than a static policy statement. NIST Cybersecurity Framework 2.0 reinforces this shift toward continuous risk management and ongoing governance, rather than one-time attestation, and that matters when identities can act autonomously or at machine speed. Definitions vary across vendors on whether the term is an access review process, a runtime control, or a broader trust-scoring model, so implementation details are still evolving across the industry. NHI Management Group treats the term as a governance discipline that connects certification, telemetry, and revocation into one loop. The most common misapplication is treating a quarterly access recertification as continuous certification, which occurs when no runtime signal is used to confirm the identity still deserves its active privileges.
Examples and Use Cases
Implementing Continuous Certification of Trust rigorously often introduces monitoring overhead and policy complexity, requiring organisations to weigh tighter control against operational friction and latency.
- An AI agent is allowed to call a customer-support API only while it remains inside an approved task, and the permission is withdrawn if it begins invoking unrelated tools.
- A service account that normally handles billing jobs is re-certified at runtime by checking workload identity, source context, and recent secret usage before each privileged action.
- A temporary integration token is trusted for a specific deployment window, then challenged again when the pipeline changes, rather than being accepted until its expiry date.
- NHI Management Group’s Ultimate Guide to NHIs — What are Non-Human Identities is useful when mapping the lifecycle signals that should feed re-certification decisions.
- The NIST Cybersecurity Framework 2.0 helps organisations frame these checks as part of broader identify, protect, and detect functions rather than as an isolated IAM task.
Why It Matters in NHI Security
Continuous Certification of Trust matters because NHI compromise rarely begins with a dramatic login event; it more often starts when a valid identity keeps privileges it no longer deserves. In NHI Management Group research, 97% of NHIs carry excessive privileges, and 80% of identity breaches involved compromised non-human identities such as service accounts and API keys. That combination makes stale trust especially dangerous in agentic systems, where authority can be exercised without a human pause point. Continuous re-certification helps detect privilege drift, stolen tokens, mis-scoped delegations, and agents that have wandered beyond their intended function. It also supports governance evidence by showing that authority was not granted once and forgotten, but continuously justified against live conditions. The Sisense breach is a reminder that identity exposure can become materially damaging when credentials and access paths remain trusted too long, and the Ultimate Guide to NHIs — What are Non-Human Identities shows how common overexposure remains across enterprise environments. Organisations typically encounter the consequence only after an agent, token, or service account has already executed beyond its intended scope, at which point continuous certification becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 | Covers lifecycle and privilege drift risks that continuous certification is meant to catch. |
| OWASP Agentic AI Top 10 | AGENT-04 | Agent runtime guardrails depend on ongoing trust reassessment as behavior changes. |
| NIST CSF 2.0 | PR.AC-4 | Least-privilege access must be maintained, not merely granted at onboarding. |
| NIST Zero Trust (SP 800-207) | Zero Trust requires continuous verification of identity and authorization decisions. | |
| NIST AI RMF | GOVERN 3 | AI risk governance calls for ongoing monitoring of model and agent behavior. |
Re-check active NHIs against current task scope and revoke authority when context no longer justifies it.
Related resources from NHI Mgmt Group
- When does continuous monitoring matter more than access certification?
- What is the difference between access certification and continuous monitoring in ERP security?
- How should security teams implement continuous authorization in zero trust environments?
- What is the difference between MFA and continuous authentication in zero trust?
