TL;DR: Clarity Security argues that identity governance was built around human access review and lifecycle control, but NHI sprawl and AI agents expose a control gap because identities can move faster than legacy IGA processes can track. Access review assumes a stable identity long enough to certify, yet machine and agent identities can appear, change, and disappear on operational timelines that break that assumption.
At a glance
What this is: This is an identity governance explainer that argues legacy IGA assumptions break down when NHIs and AI agents operate on faster, less stable lifecycle patterns than human accounts.
Why it matters: It matters because IAM, IGA, and PAM teams now have to govern access that may never fit a human-style review cadence, especially where credentials, offboarding, and certification are involved.
👉 Read Clarity Security's analysis of identity governance for NHIs and AI agents
Context
Identity governance is the layer of IAM that decides who or what should have access, for how long, and under what business rule. The control gap appears when that model is applied to NHIs and AI agents whose access can be provisioned, used, and retired on timelines that human-centric governance never assumed.
Clarity Security frames this as a lifecycle and assurance problem as much as an access problem. The article’s core claim is that review, evidence, and revocation processes built for employees do not automatically translate to service accounts, tokens, or agent identities.
That makes this a governance issue, not just a tooling issue. The starting point for most organisations is still human IAM, but the article argues the scope now extends into machine and agent identity governance as well.
Key questions
A: The main failure is that certification and lifecycle controls assume a stable identity with a human-style ownership model. NHIs and AI agents can be created, delegated, and retired on operational timelines that make periodic review too slow to serve as the primary control. Governance has to shift toward ownership, issuance, and revocation state.
Q: Why do AI systems create NHI governance problems?
A: AI systems often rely on service accounts, tokens, APIs, and delegated permissions that behave like non-human identities. If those identities are not governed tightly, the system can access data or trigger actions beyond what people intended. That makes AI governance inseparable from identity and access control.
Q: How should security teams include non-human identities in IGA?
A: Treat service accounts, tokens, and application identities as governed assets with owners, purpose, expiry, and review cadence. Do not leave them in separate tooling or rely on ad hoc documentation. The same lifecycle discipline used for workforce access should apply to NHI populations, especially where elevated permissions or long-lived credentials are involved.
Q: When should organisations prioritise posture management for NHIs and AI agents?
A: Prioritise it before large-scale deployment, not after incidents or budget reviews. If visibility is limited, excess privilege and stale credentials will accumulate faster than teams can remediate them. Baseline discovery and exposure mapping should come before expansion, because they reduce the size of the blind spot that attackers exploit.
Technical breakdown
Why legacy identity governance fails for NHIs and AI agents
Identity governance systems were designed to certify access that is visible, durable, and owned by a person or a clearly managed account. NHIs and AI agents disrupt that model because they may be created dynamically, used for one task, and retired outside the normal review cycle. That breaks assumptions behind access certification, orphaned-account detection, and lifecycle evidence. In practice, governance systems see the artefact too late or in the wrong state, which means review becomes retrospective paperwork rather than a control over current access state.
Practical implication: teams need to govern issuance and revocation state, not only periodic certification results.
How lifecycle automation changes NHI and agent governance
Lifecycle automation is the operational heart of identity governance, but its design usually reflects employee joiner-mover-leaver patterns. For NHIs, the lifecycle often maps to application deployments, pipeline changes, vendor relationships, or service retirement. For AI agents, the relevant lifecycle can be even shorter and more event-driven, tied to task execution or delegated tool access. The governance challenge is not whether automation exists, but whether it is bound to the right identity subject, ownership record, and offboarding trigger. Without that alignment, automation can create speed without assurance.
Practical implication: align identity lifecycle controls to the actual event that creates or ends machine access.
Why access reviews and evidence collection must be rethought
Access reviews are often treated as the proof that governance is working, but they only help when the identity is still present and the entitlement still exists. NHIs and AI agents can make that proof unstable because their access may be transient, delegated, or chained through other systems. Evidence collection therefore needs to move closer to runtime events, entitlement changes, and ownership boundaries. Otherwise, auditors may see a clean review record while the real risk sits in unreviewed non-human access outside the certification window.
Practical implication: supplement certification with continuous evidence of entitlement, ownership, and revocation state.
NHI Mgmt Group analysis
Identity governance is no longer a human-only control plane. The article’s central problem is not that IGA is obsolete, but that its original operating assumptions were built for people and persistent accounts. NHIs and AI agents change the governance subject, the timing model, and the evidence model at the same time. Practitioners should treat identity governance as a cross-actor discipline, not a human-only process.
Access review is a lagging control when identities are short-lived. Certification works when access persists long enough to be observed, challenged, and revoked. That assumption weakens sharply for service accounts, tokens, and delegated agent access that may never survive a review cycle. The implication is that control design has to move upstream to provisioning, ownership, and revocation triggers.
Lifecycle ownership matters more than lifecycle automation. Many programmes automate joins, moves, and leaves, but automation without a real owner still leaves governance gaps. When the identity is non-human, the business owner, system owner, and technical custodian can easily diverge. That makes orphaned access and unclear accountability the real failure mode, not the absence of a workflow alone.
AI agents force identity governance to confront runtime delegation. A human can approve a request once and remain accountable for the result, but an agent can continue acting through delegated access after the approving context has faded. That breaks the tidy separation between request, approval, and use that older IGA models rely on. Teams need to rethink how governance records follow delegated action, not just assigned entitlement.
Role models still matter, but they are not enough. Role-based access control can reduce chaos, yet it does not solve lifecycle drift, owner ambiguity, or transient non-human access. The named concept here is identity governance control gap: the mismatch between human-centric governance design and machine-speed identity behaviour. Practitioners should use that gap as the lens for re-scoping IGA programmes.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
What this signals
Identity governance control gap: The article points to a structural mismatch between human-era governance and machine-speed identity behaviour. For programmes that now include NHIs and AI agents, the question is no longer whether access is reviewed, but whether governance still follows the real lifecycle of the identity subject.
Access certification remains useful, but it cannot be the only proof of control when access can be provisioned and retired faster than a review cycle. That pushes practitioners toward ownership binding, offboarding triggers, and entitlement state as the real governance signals.
For practitioners
- Define NHI and agent ownership records Map every service account, token, certificate, and AI agent to a named business owner and a technical custodian. Require those ownership fields before access is approved or renewed.
- Tie revocation to lifecycle triggers Link offboarding to deployment retirement, vendor termination, workload replacement, and agent decommissioning instead of relying on periodic review alone.
- Extend access reviews beyond human accounts Include non-human identities in certification scope and require reviewers to validate purpose, owner, and current runtime need rather than entitlement presence only.
- Inventory identity sprawl by identity type Separate humans, NHIs, and AI agents in the inventory so governance workflows can use the right lifecycle logic for each class.
- Track orphaned access as a governance metric Measure how many non-human identities lack an owner, a current purpose, or a clear offboarding trigger, then use that metric to prioritise cleanup.
Key takeaways
- Identity governance built for employees will miss important risk if it is not extended to NHIs and AI agents with their own lifecycle logic.
- The article’s core warning is that review and certification can lag behind machine-speed access changes, leaving evidence weaker than the actual exposure.
- The most effective control shift is to govern ownership, purpose, and revocation state at the moment access is created or retired.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article centers on lifecycle control gaps that leave non-human access active beyond its useful life. |
| NHI-05 — Overprivileged NHI | Legacy governance can leave machine identities with access that outlives the original business need. | |
| NHI-10 — Human Use of NHI | The article highlights how human-centric governance can blur accountability for machine access decisions. | |
| Recommendation — Track non-human identities to their offboarding trigger and revoke access when the owning service or agent is retired. Review non-human entitlements against current purpose and remove access that exceeds the identity's active role. Separate human approvals from machine execution so each NHI action has a clear accountable owner. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege is the baseline governance principle challenged when NHIs and agents retain unnecessary access. |
| Recommendation — Apply least-privilege reviews to non-human accounts and remove entitlements that are no longer required for operation. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about whether access permissions remain governed as identities change over time. |
| GV.RR-01 — Organizational roles, responsibilities, and authorities are established and communicated | Ownership ambiguity is a core failure mode when machine identities are added to IGA programmes. | |
| Recommendation — Maintain current entitlement records for NHIs and agents so authorisation decisions reflect the present state, not stale approvals. Assign clear identity ownership for each NHI and AI agent so governance actions have a named decision-maker. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | Cloud governance of service accounts, tokens, and delegated access falls squarely in the IAM domain. |
| Recommendation — Map non-human identities to cloud IAM controls and verify their lifecycle rules match operational ownership. | ||
Key terms
- Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Lifecycle Management: Lifecycle management is the process of creating, reviewing, rotating, and retiring identities and their secrets in a controlled way. For NHIs, it is essential because stale credentials, orphaned accounts, and incomplete offboarding are common paths to long-lived exposure and unauthorised access.
- Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
What's in the full article
Clarity Security's full blog post covers the operational detail this post intentionally leaves for the source:
- How the vendor frames identity governance as a response to SOX-era control expectations
- The role of automation in lifecycle management for access reviews and orphaned account reduction
- Examples of how audit and compliance objectives shape identity governance programmes
- The vendor's view on how its platform is positioned against audit failures and lifecycle risk
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 1, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org