A trust design in which one organisation alone can create or approve access decisions that downstream systems accept. In identity governance, unilateral custody is risky because compromise of that single holder can become compromise of every relying application.
Expanded Definition
Unilateral custody describes an identity trust model where a single organisation is the sole authority that can create, approve, or revoke access decisions, and downstream systems accept those decisions without a second custodian or independent check. In NHI security, this pattern often appears in service account governance, API key issuance, token signing, or automated access approval flows.
The concept is broader than simple administration rights. It is about concentrated control over trust itself. That makes it different from delegated administration, federated identity, or tightly scoped approval workflows, where another system or party can verify what is being asserted. Guidance varies across vendors, but the security concern is consistent: when one holder can both mint and validate access, compromise of that holder can cascade into every relying application. NIST’s NIST Cybersecurity Framework 2.0 reinforces the need for governed, resilient access controls rather than single-point trust. The most common misapplication is treating unilateral custody as routine automation, which occurs when teams let one pipeline or admin domain both issue credentials and approve their use without independent oversight.
Examples and Use Cases
Implementing unilateral custody rigidly often introduces operational friction, requiring organisations to weigh deployment speed against the risk of an irreversible trust bottleneck.
- A CI/CD platform issues API tokens and also authorises the applications that consume them, leaving no independent review path if the pipeline is compromised.
- A central identity service signs assertions for multiple downstream apps, and those apps accept the signature without a separate policy engine or second approval source.
- A partner integration depends on one organisation to both create and validate the credential used for cross-domain access, making the partner trust relationship fragile.
- A secrets automation tool rotates credentials but is also the only system allowed to approve production usage, so a tooling compromise can silently expand access.
- NHI governance programs referencing the Ultimate Guide to NHIs use custody separation to reduce the blast radius of service account compromise while aligning with the least-privilege intent in NIST Cybersecurity Framework 2.0.
In practice, teams usually discover the need for this concept during credential rotation, offboarding, or incident response, when they notice that one trust anchor controls too many dependent systems.
Why It Matters in NHI Security
Unilateral custody matters because NHI compromise rarely stays isolated. If one organisation can mint trust decisions alone, that organisation becomes the highest-value target in the access chain. An attacker who gains that control may impersonate service accounts, issue tokens, or push approvals that downstream applications cannot distinguish from legitimate actions. This is especially dangerous in environments with broad secret exposure, where NHI Mgmt Group reports that 96% of organisations store secrets outside secrets managers in vulnerable locations, and 97% of NHIs carry excessive privileges. Those conditions make single-holder trust models far easier to exploit.
The governance lesson is straightforward: the more a system relies on one custodian to create and validate access, the more it needs compensating controls such as independent verification, strong lifecycle management, and break-glass oversight. The Ultimate Guide to NHIs frames this as part of broader visibility and offboarding discipline, not just a technical detail. Organisations typically encounter the damage only after a credential leak or pipeline breach, at which point unilateral custody becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Single-holder trust concentrates NHI control and increases blast radius. |
| NIST CSF 2.0 | PR.AC-4 | Access permissions should be managed and reviewed to prevent concentrated trust. |
| NIST Zero Trust (SP 800-207) | Zero Trust rejects implicit trust in a single access decision source. | |
| NIST SP 800-63 | AAL2 | Assurance levels help bound how strongly a trust assertion can be accepted. |
| OWASP Agentic AI Top 10 | AI-04 | Agentic systems can create unilateral custody when one tool chain controls approvals. |
Require continuous verification and policy checks instead of accepting one custodian's decision as final.
