Human-mediated access is any identity event that depends on a person making a judgment or taking an action to grant, restore, or expand access. Examples include password resets, approval workflows, and exception handling, all of which attackers can target through manipulation or impersonation.
Expanded Definition
Human-mediated access covers access decisions that cannot be completed by policy alone because a person must interpret context, verify intent, or approve an exception. That can include help desk resets, privileged exception requests, temporary elevation, break-glass access, and manager approvals for sensitive systems. In identity security, the key issue is not simply that a human is involved, but that the access path depends on judgment, which creates a social engineering surface and an audit challenge. The term is adjacent to access governance, privileged access management, and workflow approval, but it is narrower than general identity administration because it focuses on the point where a person becomes the control. NHI Management Group treats this as a high-risk boundary because adversaries often target the reviewer, approver, or operator rather than the target account itself. For a control baseline, NIST SP 800-53 Rev 5 Security and Privacy Controls provides relevant governance patterns for access enforcement, incident handling, and privileged functions. The most common misapplication is treating human-mediated access as a routine ticketing step, which occurs when organisations assume an approval form alone is sufficient to prove legitimate need.
Examples and Use Cases
Implementing human-mediated access rigorously often introduces delay and review overhead, requiring organisations to weigh responsiveness against stronger abuse resistance.
- Password reset workflows where a service desk agent verifies identity before restoring access, often under attack from impersonation or pretexting.
- Privileged access approval flows where a manager or owner must authorise time-bound elevation for administrative work, especially in tightly controlled environments.
- Break-glass activation for emergency access when automated controls fail, with post-event review needed to confirm the action was justified.
- Exception handling for access requests that do not fit normal policy, such as temporary third-party access or emergency vendor support.
- Recovery of access to non-human identity tooling or admin consoles when an operator must manually confirm intent before restoring tokens or credentials, a pattern increasingly relevant in OWASP Non-Human Identity Top 10-aligned governance work.
These cases show the operational value of a human decision, but they also expose a process to manipulation if the verifier relies on weak signals, informal channels, or inconsistent documentation.
Why It Matters for Security Teams
Human-mediated access matters because it is often the control path attackers try to reshape, bypass, or exploit when automated controls are too rigid to move, too slow to respond, or too easy to socially engineer. If the organisation relies on humans to grant access, then the quality of identity proofing, approval criteria, and escalation handling directly affects security outcomes. This is especially important in privileged access management, help desk operations, and NHI administration, where a single mistaken approval can restore powerful access to the wrong party. Security teams should treat these moments as governed control points, not informal exceptions, and ensure that every manual grant has a traceable reason, bounded duration, and reviewable evidence. The control intent in NIST SP 800-53 Rev 5 Security and Privacy Controls aligns with that approach by emphasising accountable access enforcement and auditability. Organisations typically encounter the full cost of human-mediated access only after a reset abuse, over-approval, or break-glass misuse, at which point the process becomes operationally unavoidable to fix.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5, NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA | Access authorization and identity management principles apply to manual access decisions. |
| NIST SP 800-53 Rev 5 | AC-2 | Account management controls govern provisioning, review, and removal of access. |
| NIST SP 800-63 | IAL2 | Identity proofing strength affects whether a human can safely restore or expand access. |
| OWASP Non-Human Identity Top 10 | Manual access to NHI consoles and credentials is a recurring governance risk in NHI security. | |
| NIST Zero Trust (SP 800-207) | Zero trust principles require explicit verification before any access is granted or restored. |
Require documented approval, identity verification, and traceable access decisions for every manual grant.
