Cerbos pricing shows why monthly active principles fit identity governance

At a glance

What this is: This interview explores Cerbos’s pricing shift to monthly active principles and finds that access governance is better measured across all unique identities interacting with authorization, not only named users.

Why it matters: IAM teams should care because the same identity mix that complicates pricing also complicates governance, entitlement visibility, and auditability across human, machine, and delegated access.

Context

Access control pricing becomes harder to interpret when the unit of value does not match the unit of governance. In this discussion, the primary issue is not software licensing alone but how to count the identities that actually consume authorization decisions across a real environment.

Monthly active principles is a commercial metric, but it reflects a governance problem that IAM and NHI teams already face: people, service accounts, and other machine identities rarely share the same lifecycle, yet they all create entitlement, audit, and operational overhead. That makes the pricing conversation a useful proxy for how access control programs should think about scope.

Key questions

Q: How should IAM teams count identities when access is used by both people and machines?

A: Count every distinct identity that receives authorization decisions, not just named users. That includes service accounts, workload identities, and delegated credentials if they independently consume policy. The useful governance question is whether your reporting denominator matches the real population under control, because access reviews and budget forecasts both fail when the counted unit is too narrow.

Q: Why do user-based access metrics break down in mixed identity environments?

A: User-based metrics assume the main governance burden comes from people, but many modern authorization systems are consumed by software identities as well. Once machine identities are part of the decision path, the access estate grows beyond headcount. That changes audit scope, lifecycle ownership, and cost predictability, so user-only accounting understates both operational and security effort.

Q: What goes wrong when access governance is measured by activity volume instead of identity population?

A: Activity volume measures traffic, not governed access. Two environments can generate similar request counts while having very different numbers of identities, ownership boundaries, and review obligations. That makes volume a poor proxy for authorization scope. Teams end up optimising for usage noise instead of knowing which identities actually need lifecycle management and access oversight.

Q: Should organisations manage human and machine identities under the same access governance model?

A: They should govern them under the same programme, but not with identical controls. The shared requirement is visibility into who or what is authorised. The difference is that machine identities usually need tighter ownership, shorter lifecycle expectations, and clearer operational handoff. A single programme works best when it distinguishes subject type while keeping one governance record.

Technical breakdown

Why monthly active identities fit authorization better than users

Authorization systems do not only answer whether a named employee may take an action. They also serve service accounts, workload identities, API-driven automation, and external users that all require distinct policy treatment. A metric based on monthly active principles therefore tracks the true population interacting with the decision engine, rather than assuming a human-user model that stops scaling once machine identities dominate. For IAM teams, this matters because pricing models often expose the same accounting problem that governance models face: if you cannot enumerate who or what is being authorized, you cannot govern access consistently.

Practical implication: Treat access-control scope as an identity-population problem, not a user-count problem.

How predictable pricing reflects authorization governance

Usage-based models tied to API calls or data volume can obscure the real cost drivers in access-control platforms because they measure system activity rather than governed identities. By contrast, counting active identities creates a more stable relationship between business growth and licensing, especially where enterprise buyers need forecastable spend. The governance parallel is direct: the more predictable the identity inventory, the easier it is to reason about entitlements, audit coverage, and service ownership. When pricing is aligned to identity presence, it reinforces the same operational discipline that identity teams need for lifecycle management.

Practical implication: Anchor operational reporting to governed identities so cost and access oversight use the same counting logic.

Why mixed human and machine populations change access strategy

The article’s core insight is that modern authorization rarely serves humans alone. Human users, service accounts, and other machine identities can all sit inside the same authorization plane, but they do not behave the same way, and their governance requirements differ. That creates a structural challenge for teams still designing access programs around employee-centric assumptions. Once machine identities become part of the governed population, access policy, lifecycle ownership, and auditability need to extend beyond traditional IAM boundaries. The practical lesson is that authorization design now sits at the intersection of human IAM and NHI governance.

Practical implication: Extend authorization governance to service accounts and other machine identities as first-class subjects.

NHI Mgmt Group analysis

Monthly active principles are a useful proxy for access governance because they count the identities that actually consume authorization decisions. The article shows why user-based pricing can miss the real operational unit once machines, services, and delegated identities participate in the same control plane. That is not a billing nuance; it is a signal that identity programmes need a population model, not just a person model. Practitioners should use the same logic when scoping entitlement review and audit coverage.

Access control now lives inside mixed identity estates, so commercial models are exposing an IAM truth that many programmes still undercount. When service accounts and human users flow through the same authorization logic, the boundary between IAM and NHI governance becomes operational rather than theoretical. The implication is that teams should stop treating machine identities as edge cases and start measuring them as part of the governed identity estate.

Predictability matters because access control fails when cost, scope, and governance are measured in different units. The article’s emphasis on understandable pricing mirrors a common enterprise requirement: security controls need metrics business teams can forecast and audit teams can verify. That makes monthly active principles a governance-friendly counting method, especially where access spans multiple identity types.

Identity population drift: once authorization is consumed by humans and machines together, the programme can no longer assume a stable user-centric denominator. The article surfaces a broader market shift toward pricing and governance models that recognise that drift explicitly. Practitioners should align budgeting, entitlement review, and lifecycle controls to the full identity population, not just named users.

From our research library:

• Software supply chain attacks were projected to cost organisations $60 billion in 2025.

What this signals

Monthly active principles expose the real denominator problem in access governance. Once software identities share the authorization plane with humans, programme leaders need one accounting model that can describe both spend and control coverage without hiding machine activity inside generic user totals.

The more mixed the identity estate becomes, the less useful employee-centric access assumptions are. Teams should expect entitlement review, ownership assignment, and budget forecasting to converge around the same identity inventory, because separate counts for security and finance create blind spots in both.

For practitioners

• Map your authorization population Inventory every identity type that consumes access decisions, including employees, contractors, service accounts, workload identities, and delegated tokens. Use that inventory as the denominator for governance reporting, support planning, and licensing discussions.
• Separate identity count from activity volume Do not let API calls, request traffic, or data transfer become your primary measure of authorization scope. Track how many distinct identities are active in a month, then compare that against policy coverage and review frequency.
• Align lifecycle ownership to machine identities Assign explicit owners for non-human identities so that rotation, offboarding, and access review do not disappear into platform administration. If ownership is unclear, the identity will be counted in spend but omitted from governance.
• Use forecastable access metrics in vendor evaluation When assessing authorization platforms, ask whether the pricing unit matches how your organisation actually governs access across human and machine identities. A metric that your finance and security teams can both explain reduces later surprises.

Key takeaways

• Monthly active principles are a better governance lens than user counts when access decisions are made for both people and machines.
• Pricing predictability and access predictability are linked, because both depend on counting the actual identities under management.
• IAM programmes should extend ownership, review, and reporting to service accounts and other non-human identities as first-class subjects.

Key terms

• Monthly Active Principles: A usage metric that counts the unique identities interacting with a system over a month, including people and machines. It is useful when the access surface includes users, service accounts, workloads, and other non-human principals that all consume policy, audit, and operational capacity.
• Mixed Identity Estate: An environment where humans and non-human identities are both active consumers of access control, entitlement, or authentication services. The governance challenge is that each subject type has different lifecycle, ownership, and review needs, yet all still contribute to the same operational and security workload.
• Access Control Plane: The layer that coordinates identity, policy, approvals, enforcement, and logging across multiple systems. It matters because modern access decisions are rarely made in one place, and fragmentation across tools can turn governance into disconnected evidence.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.