Autonomous identity still depends on governance for NHI access

At a glance

What this is: This is Lumos’s case for autonomous identity governance, centred on the claim that identity has become the main attack surface and that NHI access still depends on visibility, least privilege, JIT controls, and faster review cycles.

Why it matters: It matters because IAM, IGA, and PAM teams have to govern human and non-human access in environments where access grows faster than manual certification, making revocation and accountability the real control problem.

Context

Lumos is describing a governance problem, not an infrastructure problem. The article argues that attackers increasingly rely on valid credentials and that identity has become the primary control point for both human and non-human access.

For IAM and IGA teams, the important shift is that traditional review and approval cycles were built for slower change. Service accounts, bots, and other NHIs accumulate access quickly, which makes visibility, least privilege, and timely revocation the deciding controls.

The article is also making an operational point about scale. If identity programmes cannot keep pace with app sprawl and dynamic access changes, access governance becomes reactive instead of preventive.

Key questions

Q: What breaks when service accounts are not centrally governed?

A: When service accounts are created and maintained outside a central identity process, ownership, purpose, and retirement become unclear. That creates hidden credentials, weak accountability, and access that outlives the workload it was meant to support. The result is not just inventory drift, but a persistent governance gap that IAM and PAM teams cannot close with human identity controls alone.

Q: Why do standing NHI permissions increase operational risk?

A: Standing permissions enlarge the window in which any credential can be reused, misrouted, or overexposed. If a service account keeps broad access after the immediate task is done, the account becomes harder to govern and easier to abuse, especially in environments where apps and integrations change constantly.

Q: What are the signs that NHI governance is failing in an enterprise?

A: Common warning signs include unclear ownership for service accounts, secrets stored in code or configuration instead of managed vaults, infrequent rotation, and weak offboarding of API keys. Other red flags are excessive permissions, third-party exposure without controls, and low visibility into where non-human identities exist or how they are used across the stack.

Q: When should teams prioritise JIT access over persistent access for NHIs?

A: Prioritise JIT access when the workload needs elevated rights only for a task, a deployment, or a short troubleshooting window. Persistent access is harder to justify when the entitlement exists mainly for convenience rather than continuous operation, because the extra exposure rarely buys equivalent value.

Technical breakdown

Why identity has become the attack surface

The article frames identity as the point where modern attacks succeed, because adversaries do not need to break the perimeter if valid credentials already open the door. In practice, this shifts the control problem from network defence to access governance. For non-human identities, the issue is not just authentication, but whether the credential has a clear owner, limited scope, and a lifecycle that matches the workload it serves. When those controls are absent, access becomes the attacker’s easiest path. The governance implication is that identity inventory and entitlement control now sit in the same critical path as detection and response.

Practical implication: treat identity inventory and entitlement scope as frontline security controls, not administrative records.

How least privilege and JIT access constrain non-human identities

Lumos links access sprawl to the way identities accumulate permissions over time. Least privilege reduces the default blast radius by keeping permissions narrow, while Just-in-Time access creates an expiry window for elevated rights instead of leaving them permanently available. For service accounts and other NHIs, the key architectural point is that privilege should be issued for a task, not retained as a standing entitlement. That matters because machine access often persists longer than the operational need that justified it. In environments with fast-moving apps and many integrations, standing privilege becomes a governance debt that compounds exposure.

Practical implication: move NHI access toward task-scoped privilege with expiry, rather than relying on persistent entitlements.

Why access reviews fail when they stay manual

The article calls out rubber-stamp reviews as a compliance exercise that does not meaningfully govern access. Manual recertification works poorly when the environment changes faster than reviewers can inspect it, especially when the subject is a service account or bot whose access may be broad, stale, or poorly attributed. AI-assisted review is presented as a way to surface outliers, but the deeper issue is that review alone is too late if entitlement assignment is already uncontrolled. Governance has to start with issuance, ownership, and dynamic policy enforcement, not only with quarterly certification.

Practical implication: use access reviews to catch exceptions, but enforce ownership and policy at issuance time.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
• Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity governance is now the control plane for both human and non-human access. Lumos is right to frame identity, not infrastructure, as the centre of modern attack paths. When valid credentials are enough to reach valuable systems, the governance question becomes who or what is entitled to act, for how long, and with what revocation path. Practitioners should treat identity governance as a runtime security function, not a back-office certification process.

Access sprawl is the structural failure mode, and NHIs amplify it. Human users usually have visible ownership and offboarding triggers, but service accounts, bots, and app-linked identities often accumulate permissions without an equally strong lifecycle. That creates entitlement drift that manual reviews rarely correct. The practical conclusion is that NHI access needs explicit ownership and lifecycle governance, not just authentication and logging.

Just-in-Time access is only useful if the standing-access assumption is removed. The article’s core governance insight is that persistent permissions become a liability when work is dynamic and access demand is short-lived. JIT changes the risk profile because it compresses the exposure window and reduces what an attacker can reuse. For NHI programmes, that means standing privilege should be the exception, not the default operating model.

AI-assisted review can reduce reviewer fatigue, but it does not solve entitlement design. The real problem is not review volume alone, it is that many organisations still model access in ways that are too static for app-saturated environments. Recommendations and anomaly flags help only when the underlying roles, owners, and policies are already coherent. Teams should therefore see automation as an accelerator for governance, not a substitute for it.

Autonomous identity changes the economics of governance, not the need for governance. The article’s vision is automation, but the lasting control requirement remains accountability, revocation, and timely review. If an identity can act quickly and at scale, then governance has to become equally dynamic. The implication for practitioners is to redesign controls for speed, traceability, and exception handling rather than assuming manual processes can keep up.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Access Reviews and Certification Guide

What this signals

Autonomous identity governance should be judged by whether access can still be attributed, scoped, and revoked at the speed modern work now requires. Legacy review cadences were designed for slower change, which is why NHIs often slip through as accumulated access rather than deliberate policy.

The programme signal to watch is not just how many identities exist, but how many can be explained in terms of owner, purpose, and expiry. If that answer is missing for service accounts and bots, governance has already shifted from control to cleanup.

For practitioners

• Map all service accounts and bots to named owners Create an inventory that links each non-human identity to a business owner, technical steward, and revocation path so accountability is not ambiguous when access changes.
• Reduce standing privilege on high-value NHI accounts Replace persistent broad entitlements with task-scoped access and expiry where the workload does not require continuous permission.
• Use Just-in-Time controls for elevated access Reserve elevation for time-bound tasks and ensure the grant expires automatically once the task or session is complete.
• Prioritise access review exceptions over bulk approvals Route outliers, dormant access, and high-risk NHI entitlements to focused review instead of relying on mass recertification clicks.
• Track visibility gaps across the service-account estate Measure how many service accounts lack full visibility and use that gap as a programme metric for governance maturity.

Key takeaways

• Modern identity attacks succeed when valid credentials provide direct access and governance cannot keep pace with who or what holds them.
• Only 5.7% of organisations have full visibility into their service accounts, which shows how wide the governance gap still is.
• The practical response is to reduce standing privilege, tighten ownership, and move review effort toward exceptions and expiry-driven access.

Key terms

• Autonomous Identity: An access governance model where identity decisions are made continuously with policy and automation rather than only through periodic human review. It is meant to keep pace with dynamic apps, machine identities, and fast-changing permissions while still preserving auditability and accountability.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
• Access Sprawl: The gradual accumulation of permissions across users, services, and integrations until no one can easily explain why access still exists. In NHI environments, it often appears when machine identities keep inherited rights long after their original business purpose has changed.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.