The selection and validation of which identity proofing path is acceptable for a specific policy outcome. It matters when multiple credentials, documents or digital wallets can satisfy the same requirement, because the organisation must still define equivalence, authority and auditability.
Expanded Definition
Evidence routing is the governance decision that determines which proof path is acceptable for a given identity-related outcome, and how that evidence is validated before it is trusted. In practice, it sits between policy and execution: the policy may require assurance, but evidence routing decides whether a passport, a verified digital wallet credential, a device-bound attestation, or another approved artifact satisfies that requirement. Definitions vary across vendors and programmes, so NHI Management Group treats it as an assurance-routing control rather than a mere document selection step.
This matters because equivalence is not automatic. Two proofs can appear similar while carrying different issuers, freshness, revocation properties, or audit value. A routing rule must therefore account for authority, context, and traceability, then map the chosen path to the relevant control objective. That makes evidence routing closely related to identity proofing and assurance alignment in NIST SP 800-63A, even though the operational question is often broader than one standard’s wording. The most common misapplication is treating any available credential as equivalent evidence, which occurs when policy owners do not define issuer trust, freshness, and fallback rules.
Examples and Use Cases
Implementing evidence routing rigorously often introduces more review and exception handling, requiring organisations to weigh faster onboarding against stronger assurance and better auditability.
- A workforce identity system routes employees with a government-issued document plus live verification into a high-assurance path, while lower-risk access requests require only a verified enterprise credential.
- A customer onboarding flow accepts a mobile wallet credential only when the issuer, revocation status, and presentation method match the policy outcome, rather than accepting the wallet by default.
- A regulated service chooses a different evidence path for account recovery than for day-to-day login, because recovery demands stronger proof of control and a clearer audit trail.
- An NHI control plane uses policy to decide whether a new service account request can be satisfied by automated attestation or must be escalated to manual review, reducing over-issuance risk.
- Research into Ultimate Guide to NHIs shows why routing matters in adjacent NHI workflows, especially where proof, access, and revocation are tightly linked to governance. Comparable assurance logic appears in NIST Cybersecurity Framework 2.0 when organisations translate policy into repeatable control decisions.
Why It Matters in NHI Security
Evidence routing becomes security-critical when identities, secrets, or delegated access depend on a proof step that is assumed rather than explicitly governed. Without it, organisations may accept a weak or inappropriate proof path, creating gaps in authorisation, compliance, and later forensics. This is especially dangerous in NHI environments where access decisions affect service accounts, API keys, and agentic workflows that can act at machine speed. NHI Mgmt Group reports that only 5.7% of organisations have full visibility into their service accounts, which makes proof-path governance even more important because weak routing decisions can hide inside otherwise automated processes.
Real incidents show how quickly evidence quality becomes a control issue. Cases such as JetBrains GitHub plugin token exposure and Hard-Coded Secrets in VSCode Extensions show how trust can be misplaced when organisations do not control which evidence path is actually being used. Organisations typically encounter evidence-routing failures only after an access dispute, revocation problem, or audit finding exposes that the wrong proof was accepted, at which point the term becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-63, NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | AAL2 | Identity proofing and assurance levels depend on choosing acceptable evidence paths. |
| NIST CSF 2.0 | PR.AC-1 | Access decisions rely on validated identity evidence before granting entitlement. |
| NIST Zero Trust (SP 800-207) | GV | Zero Trust depends on continuously validated trust decisions, including proof-path selection. |
| OWASP Non-Human Identity Top 10 | NHI-01 | NHI governance must define which evidence is acceptable for privileged service identity actions. |
| NIST AI RMF | AI governance requires traceable, fit-for-purpose evidence handling for consequential decisions. |
Map each proof path to an assurance level and reject evidence that does not meet the required strength.
Related resources from NHI Mgmt Group
- What evidence is needed to understand the impact of shadow AI agents?
- When does just-in-time access help most in DORA evidence collection?
- What is the difference between policy compliance and evidence-based compliance for AI systems?
- How can organisations reduce manual effort in access certification and evidence collection?
