AI agent and NHI growth is outpacing manual IAM governance

At a glance

What this is: Clarity Security argues that NHI growth and AI-driven attacks are outpacing manual IAM governance, with a 144:1 non-human-to-human identity ratio cited as evidence of sprawl.

Why it matters: IAM, IGA, and PAM teams need to move from ticket-based review cycles to unified governance, continuous monitoring, and context-aware access if they want control over human and machine identities.

👉 Read Clarity Security's analysis of AI agent and NHI growth outpacing manual IAM governance

Context

Manual identity governance breaks down when the number of machine identities, service accounts, bots, and AI agents grows faster than teams can review, certify, or revoke them. In that environment, visibility becomes the control problem: if identities cannot be inventoried and tied to ownership, least privilege is only an assumption.

The article frames 2026 as a year when identity governance must support both NHI sprawl and faster attack conditions. That makes the practical question less about whether identity is central and more about whether governance is continuous enough to handle identities that are created quickly, used briefly, and forgotten too easily.

Key questions

Q: What breaks when non-human identities are managed outside the IAM operating model?

A: What breaks is accountability. Without IAM ownership, non-human credentials drift into fragmented secrets tools, inconsistent review cycles, and orphaned access that persists after the workload changes. That is how machine identities become invisible trust dependencies.

Q: Why do unmanaged NHIs increase security risk even when no breach has occurred?

A: Because risk accumulates in standing privilege, forgotten accounts, and over-broad access scopes. An NHI can remain fully functional long after the original team has moved on or the application has changed, which expands the blast radius before any incident happens. The danger is structural exposure, not only compromise.

Q: How should security teams evaluate identity security platforms when NHI governance is in scope?

A: They should look for coverage across discovery, ownership, lifecycle control, access review, and remediation for both human and non-human identities. The key test is whether the platform can support policy decisions and evidence collection across service accounts, secrets, and entitlements without forcing separate workflows for each identity type.

Q: Should organisations prioritise context-aware access over static role assignment for NHIs?

A: Yes, when identities operate in dynamic environments where task, device, or location change the trust profile. Static assignment works poorly for NHIs that need narrow, temporary, or environment-specific access. Context-aware policy is better when the main problem is limiting unnecessary standing privilege without slowing legitimate work.

Technical breakdown

Why non-human identity sprawl defeats manual review cycles

Non-human identity sprawl is the accumulation of service accounts, bots, application identities, and AI agents faster than governance teams can track them. Manual, ticket-heavy processes assume identities are stable, visible, and reviewed on a predictable cadence. NHIs break that model because they are often created by application teams, used across cloud and hybrid environments, and then left behind with broad access. The result is hidden privilege growth, weak ownership, and a governance backlog that grows faster than remediation can clear it.

Practical implication: inventory NHIs by owner, environment, and access scope before recertification and offboarding become purely symbolic.

How AI-driven attacks change the access-control problem

AI-driven attacks compress the attacker timeline. Instead of waiting for manual response, attackers can enumerate exposed identities, exploit weak entitlements, and adapt their methods at machine speed. That changes identity governance from periodic review to continuous detection and response. In practical terms, broad standing access and slow permission adjustment become more dangerous because the attacker can weaponise them before a human review cycle catches up.

Practical implication: treat permission drift, excessive scope, and delayed remediation as active attack-enablement conditions, not housekeeping issues.

Why context-aware access is replacing static assignment

Static access assignments assume role, location, and device posture are enough to define trust. The article points toward attribute-based access control as the alternative because context changes faster than role design. For human access this helps reduce overexposure, and for NHIs it matters even more because service accounts and agents often operate in tightly bounded tasks where broad permanent entitlements are unnecessary. The governance gain comes from aligning access with current context rather than historical provisioning.

Practical implication: move sensitive access decisions toward context-aware policy and away from permanently granted entitlements.

Breaches seen in the wild

• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Manual IAM is no longer a viable control model for machine-scale identity growth. The governance problem is not simply volume, but the mismatch between human-paced workflows and machine-paced identity creation. Service accounts, bots, and AI agents can multiply faster than access review and offboarding processes can absorb them. The consequence is a control plane that records identity activity after the fact instead of governing it at issuance time, which means practitioners must rethink manual governance as a scaling limit rather than a process preference.

Non-human identity sprawl creates identity blast radius, not just account sprawl. When unmanaged NHIs retain high-risk access long after the business use case has changed, the issue is not the existence of the account but the persistence of authority. That persistence expands the damage any one compromised or forgotten identity can cause across cloud, hybrid, and on-premise systems. Practitioners should treat ownership, scope, and lifecycle state as part of the security boundary, not administrative metadata.

Context-aware access is becoming the default governance pattern for mixed human and machine estates. Static assignment cannot express the difference between a person signing in for a session and an NHI operating continuously in the background. Attribute-based policy gives identity teams a way to bind access to task, device, location, and time instead of leaving rights open-ended. For identity programmes, this shifts the centre of gravity from certification cadence to real-time authorisation.

Shadow IT and unmanaged AI agents are now the same governance problem in different forms. Both create identities outside the visibility of the core programme, and both widen the gap between who can act and who is accountable. The practical result is that identity governance must absorb application onboarding standards, continuous monitoring, and role ownership discipline into one model rather than treating them as separate workstreams. Teams that keep governance siloed will keep discovering risk only after it has accumulated.

Identity as a strategic control plane: The article points to a broader market shift where identity data becomes operational intelligence, not just compliance evidence. That matters because governance programmes that only report on access will miss their opportunity to inform business planning, onboarding velocity, and privilege hygiene. Practitioners should expect identity to be judged on its ability to support both security and operational clarity.

What this signals

Non-human identity sprawl is now a governance design problem, not a backlog problem. Once machine identities outnumber human identities by that margin, periodic governance cannot keep pace with creation, use, and abandonment. The programme has to move toward inventory quality, owner accountability, and issuance-time policy decisions rather than relying on later review cycles.

Identity teams should expect AI agents to accelerate the same control failures that already exist in service accounts. The practical difference is speed, not category. If standing access, weak ownership, and delayed revocation are tolerated in today’s NHI estate, AI agents will magnify those weaknesses and make manual governance visibly ineffective.

Context-aware policy will matter more than static assignment as mixed identity estates mature. Security teams should prepare for a world where access is judged by current conditions, not historical role alone. That changes how identity programmes measure success: fewer orphaned identities, fewer unreviewed entitlements, and faster adjustment when access no longer matches the task.

For practitioners

• Map every non-human identity to an owner Build an inventory that ties each service account, bot, application identity, and AI agent to a business owner, technical owner, and environment. Without ownership, review and offboarding become impossible to execute consistently.
• Replace ticket-heavy review cycles with continuous monitoring Use alerting and drift detection to surface new identities, entitlement expansion, and dormant high-risk access as they appear rather than waiting for the next certification round.
• Standardise application onboarding requirements Require new applications and agents to meet identity, logging, and access-scoping standards before they are approved for production use. This reduces shadow IT and prevents ad hoc identity creation from becoming permanent exposure.
• Shift sensitive access to attribute-based policy Use real-time context such as role, device, location, and task sensitivity to reduce standing access for both humans and NHIs. Static assignments should be the exception, not the baseline.
• Automate removal of high-risk access Trigger automatic permission reduction or revocation when drift, overprivilege, or stale access is detected. Manual intervention should be reserved for exceptions that truly need human judgment.

Key takeaways

• The article describes a structural governance gap: identity sprawl is growing faster than manual IAM processes can review, certify, or remove access.
• The source cites a 144:1 non-human-to-human identity ratio and a 44% increase from 2024 to 2025, showing that the issue is already at enterprise scale.
• The control shift is toward ownership, continuous monitoring, and context-aware access, because periodic reviews alone cannot govern fast-moving machine identities.

Key terms

• Non-Human Identity Sprawl: The rapid growth of service accounts, API keys, tokens, OAuth apps, and other machine identities across environments. In AI-heavy estates, sprawl is driven by runtime systems that create access continuously, which makes ownership, inventory, and retirement far harder than in traditional human IAM.
• Identity Drift: Identity drift is the gap between the access path originally approved and the behavior that exists later. For browser extensions, drift can appear through updates, remote configuration, publisher changes, or permission expansion, turning a trusted integration into a materially different risk.
• Context-Aware Access Review: A decision process that evaluates access requests using request intent, existing entitlements, resource sensitivity, and operational evidence. In identity programmes, it reduces blind approvals by forcing reviewers or automation to weigh the real circumstances behind the request, not just the ticket itself.
• Unified Governance Platform: A unified governance platform is a system that combines spend, risk, and control data into one reporting view. In practice, it reduces manual reconciliation and gives leaders a single operating picture for compliance, assurance, and investment decisions across the enterprise.

What's in the full article

Clarity Security's full blog post covers the operational detail this post intentionally leaves for the source:

• The article's full discussion of the 144:1 NHI ratio and how Clarity Security uses it to frame 2026 identity risk
• Specific operational recommendations for unified governance across cloud, hybrid, and on-premise identity estates
• The article's examples of deep entitlement reviews, continuous monitoring, and standardisation for new app adoption
• The full explanation of why identity is treated as a strategic business enabler, not only a security control

👉 Clarity Security's full post expands on the NHI sprawl trend, AI-driven attack pressure, and the operational changes teams are being pushed toward.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.