Governing 90+ non-human identities requires graph-based access control

At a glance

What this is: This is an analysis of why governing more than 90 non-human identity types requires graph-based visibility into ownership, effective permissions, and secrets hygiene.

Why it matters: It matters because IAM teams cannot control NHIs they cannot classify, attribute, and trace across systems, especially when standing privilege and stale credentials create hidden blast radius.

Context

Non-human identity governance fails when machine identities are treated as a loose collection of integrations instead of an inventory with owners, permissions, and credential behaviour. The article argues that the core problem is not discovery alone, but whether IAM teams can answer what each identity can do, who owns it, and how its secrets behave across clouds, SaaS, data platforms, and CI/CD pipelines.

That is an identity governance problem, not just an observability problem. Once NHIs outnumber humans by a wide margin, classification, ownership, access review, and secrets lifecycle management have to work across heterogeneous systems, or policy becomes paperwork that cannot keep pace with operational drift.

Key questions

Q: What breaks when non-human identity ownership is unclear?

A: When ownership is unclear, rotation stalls, reviews default to approval, and nobody feels safe removing access. That creates orphaned identities, stale credentials, and broad permissions that persist because the organisation cannot prove what depends on them. The result is a growing attack surface with no accountable decision-maker.

Q: Why do standing privileges make NHI incidents harder to contain?

A: Standing privilege gives a compromised or overreached machine identity a wider and longer window to act before anyone notices. When access is persistent, attackers and operational drift both benefit from extra reach, so containment depends on how quickly teams can identify scope, rotate credentials, and remove excess entitlement.

Q: How do teams know if NHI governance is actually working?

A: Look for complete inventory coverage, clear ownership, enforced rotation, and reliable decommissioning. If new credentials appear faster than they are classified, or if stale secrets stay valid after workload changes, the programme is not governing machine identities effectively.

Q: Should organisations prioritise access graphs over manual NHI inventory?

A: Yes, when machine identities span multiple clouds, SaaS tools, and data platforms. A manual inventory cannot show effective permission or relationships between owners, secrets, and entitlements, so it quickly becomes stale. An access graph is what makes cross-system governance and targeted remediation practical.

Technical breakdown

Why an access graph is the control plane for NHI governance

An access graph turns scattered machine identities into a connected model of identity, ownership, entitlement, and environment. Instead of asking each system separately, teams can ask whether a service account, integration user, or workload has effective permission to write data, reach tenant-wide scopes, or inherit privileges from another object. That matters because NHI governance breaks when inventory, ownership, and authorisation live in different tools. A graph makes those relationships queryable and explainable, which is the difference between knowing a secret exists and knowing what it can actually do.

Practical implication: model NHI identity relationships centrally so entitlement decisions are based on effective access, not isolated system records.

Secrets, keys, and long-lived credentials as graph objects

Machine identities depend on secrets, keys, and tokens, so credential hygiene is inseparable from access governance. If those artefacts are not treated as first-class objects, teams lose sight of age, last use, rotation status, and scope creep. The article’s point is that secrets become governable when they are tied to usage and permission context, not just stored in a vault. That lets security teams identify credentials that have outlived their purpose or accumulated excess reach across environments.

Practical implication: attach rotation, last-use, and scope data to each NHI secret so stale credentials can be isolated before they expand blast radius.

Ownership and explainable permission are the difference between posture and proof

An unowned machine identity is a governance failure because no one can approve changes, review access, or close exceptions. The article treats ownership as a control, not a directory field, because auditors and insurers need evidence that someone is accountable for the identity’s access pattern. Explainable permission matters for the same reason: if a team cannot show why an integration user can touch sensitive data, it cannot defend the access path or remove it with confidence. In practice, ownership is what connects policy, review, and remediation to the right identity object.

Practical implication: require named owners and review cadence for every privileged NHI before access reviews or remediation workflows can be trusted.

Threat narrative

Attacker objective: The objective is to turn a single compromised machine identity into broader access to sensitive data, administrative paths, or additional secrets.

1. Entry begins with machine identities carrying standing credentials across clouds, SaaS, data platforms, and CI/CD pipelines, which creates a broad and persistent attack surface for credential abuse.
2. Escalation follows when over-scoped secrets, tenant-wide permissions, or unowned identities let an attacker or mistake expand reach beyond the intended task boundary.
3. Impact occurs when the graph reveals or fails to reveal what the compromised identity can touch, allowing faster containment when visibility exists and broader compromise when it does not.

Breaches seen in the wild

• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Graph-based access control is now a governance requirement for NHIs, not a convenience feature. Machine identities span too many systems and permission dialects for spreadsheet governance to keep up. The category has moved from inventory management to explainable access decisions, and that means the control objective is effective permission, not just discovery. Practitioners should treat the graph as the authoritative layer for proving access and ownership.

Ownership is the missing control in most NHI programmes. A machine identity without a named owner is an access path without accountability. That breaks review, exception handling, and incident containment because nobody can defend the access or remove it cleanly. The practical conclusion is that ownership must be enforced as part of the identity record, not assigned later as documentation.

Secrets hygiene becomes measurable only when credentials are linked to usage and reach. Long-lived secrets are dangerous because they outlast the operational need that created them, then accumulate unnoticed privilege drift. The article points to a control pattern that ties last use, rotation, and entitlement scope together, which is what makes cleanup defensible. Teams should stop treating vaulting as the endpoint and start treating secret context as the governance signal.

NHI governance is shifting from static entitlements to continuous evidence. The article’s broader signal is that auditors, insurers, and security teams now need proof of who can do what, why they can do it, and whether that access still makes sense. That is a stronger model than simple inventory because it supports right-sizing and containment without waiting for quarterly review cycles. Practitioners should expect NHI programmes to be judged on evidence quality, not tool count.

Identity blast radius is the right concept for prioritising NHI remediation. The article shows that some machine identities matter far more than others because their effective permission is what turns a small credential issue into a broad operational incident. That makes blast radius, ownership, and rotation freshness the right prioritisation trio. Security teams should use those three factors to decide what to fix first.

From our research library:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs

What this signals

Identity blast radius is the operational lens that NHI programmes need. The point is not simply to count machine identities but to understand which ones can reach regulated data, tenant-wide scopes, or production controls. That is where graph-based governance changes programme decisions, because it lets teams sort the identities that matter from the ones that merely exist.

Access review cycles will keep failing unless they are grounded in machine-identity evidence. Reviews designed around human users assume a stable account, an obvious owner, and a manageable permission set. NHIs break those assumptions, so teams need usage, rotation, and scope data before certification can become more than a formality.

The category pressure is already visible: NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs, which is why governance now has to scale through models rather than manual tracking. Once machine identity volume crosses that boundary, the programme question becomes whether the control plane can prove access fast enough to keep pace with delivery.

For practitioners

• Map every NHI to an owner and purpose Require a named human owner, stated business purpose, and review cadence for each machine identity before it is accepted into production governance.
• Model effective permission in an access graph Use a graph to connect identities, entitlements, environments, and data sensitivity so you can see what each NHI can actually do across systems.
• Prioritise stale and over-scoped secrets Pull credentials with no recent use, overdue rotation, or tenant-wide scope into the first remediation queue, especially where production data is reachable.
• Scope reviews to high-blast-radius identities Focus access reviews on NHIs with admin rights, data-write access, or third-party connectivity because those identities are most likely to amplify a compromise.

Key takeaways

• Non-human identity governance fails when machine accounts are treated as isolated integrations instead of objects with owners, effective permissions, and credential behaviour.
• The article’s central claim is that graph-based access control makes NHI risk legible by connecting identity, scope, secrets, and responsibility.
• For practitioners, the priority is to prove who owns each machine identity, what it can do, and whether its access still matches the work it performs.

Key terms

• Access Graph: An access graph is a relationship model that links identities, permissions, data objects, and system interactions. In NHI governance, it helps security teams see the full path from an agent or user to the action it can take, which is more useful than isolated account reviews.
• Effective Permissions: Effective permissions are the access an identity can actually use after role inheritance, scope, and policy are applied. In Azure AI environments, they often matter more than the assigned role name because inherited rights can widen access to data, logs, and secret stores.
• Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
• Secrets Hygiene: Secrets hygiene is the practice of keeping credentials, tokens, API keys, and certificates controlled throughout their lifecycle. It includes storage, rotation, offboarding, and inventory accuracy, and it matters because exposed or stale secrets often bypass stronger cloud controls.

Deepen your knowledge

NHI governance, machine identity security, and identity lifecycle management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.