Identity governance is shifting as non-human identities outnumber humans

At a glance

What this is: Omada Identity’s podcast discussion says identity governance is shifting because non-human identities and AI agents now outnumber human accounts while many teams still rely on activity-based metrics.

Why it matters: This matters because IAM, IGA, PAM, and NHI programmes have to govern machine and agent identities with the same rigour once reserved for people, but with faster lifecycle churn and less manual oversight.

By the numbers:

• More than 95 percent of leaders now treat identity security as core to their strategy.
• Non-human identities and AI agents can outnumber human accounts by more than 100 to 1.

Context

Identity governance is the discipline of deciding who or what should have access, for how long, and under what conditions. In this discussion, the pressure point is non-human identities and AI agents, because human-centric access models assume people request, review, and renew access on a predictable cadence.

Omada Identity frames the problem as a gap between strategic awareness and operational control. Organisations may recognise the importance of identity security, but they still rely on activity counts and static reporting when they need continuous evaluation of non-human access, ownership, and accountability.

The article’s core claim is that governance now has to follow machine speed, not human workflow speed. That is an atypical position for organisations still managing identities through periodic review cycles and siloed system visibility.

Key questions

Q: What breaks when organisations govern non-human identities with human-centric review models?

A: Human-centric review models assume identities move through predictable joiner-mover-leaver stages and remain stable long enough to be certified. Non-human identities can be created, reused, delegated, and retired far faster than that, so periodic review often confirms yesterday’s access instead of today’s risk. The result is governance that looks complete while entitlement scope drifts out of control.

Q: Why do non-human identities change the way IAM teams should think about risk?

A: NHIs multiply faster than human accounts and often have broader or less visible access paths. That means IAM risk is no longer limited to user onboarding and password policy. Teams need lifecycle controls for discovery, rotation, offboarding, and privilege minimisation so machine access does not become a permanent blind spot.

Q: What are the signs that NHI governance is failing in an enterprise?

A: Common warning signs include unclear ownership for service accounts, secrets stored in code or configuration instead of managed vaults, infrequent rotation, and weak offboarding of API keys. Other red flags are excessive permissions, third-party exposure without controls, and low visibility into where non-human identities exist or how they are used across the stack.

Q: What should teams do first when machine identities outnumber human accounts?

A: Start with an inventory of all machine identities, then rank them by business criticality and credential lifetime. That gives you a practical way to target the highest-risk secrets and certificates first, instead of trying to remediate the entire estate at once.

Background and context

Why activity metrics fail for non-human identity governance

Activity metrics show that work happened, but they do not show whether the right identity had the right access for the right task. For non-human identities and AI agents, the useful questions are risk, scope, ownership, and duration, because those identities can create value or exposure without a person sitting in front of a console. Human-centric programmes often optimise for counts, approvals, and completion rates, which can all look healthy while standing access remains over-broad or unowned. Practical implication: move from volume reporting to risk-based entitlement review and ownership validation.

Practical implication: replace activity dashboards with risk-based entitlement review and ownership validation.

Why continuous zero trust evaluation matters for machine and agent identities

Zero Trust Architecture treats access as something to verify continuously rather than trust once at login. That matters for non-human identities because their access patterns can change quickly across connected systems, and AI agents may interact across multiple tools and services in a single workflow. In practice, this shifts the governance focus from periodic certification to runtime evaluation, especially where credentials, tokens, or delegated permissions can expand effective reach across systems. Practical implication: tie machine and agent access decisions to continuous policy checks instead of fixed review windows.

Practical implication: tie machine and agent access decisions to continuous policy checks instead of fixed review windows.

What ownership means when identity cannot be seen directly

Ownership is the control that keeps an identity from becoming an orphaned access path. For non-human identities, that means knowing which team created it, which system depends on it, who can revoke it, and what business function it supports. When organisations cannot answer those questions, they lose accountability even if the identity still exists in logs or configuration data. This is where identity governance and operational ownership converge, because unowned machine access is rarely neutral. Practical implication: require a named owner and lifecycle record for every non-human identity.

Practical implication: require a named owner and lifecycle record for every non-human identity.

NHI Mgmt Group analysis

Activity-based governance is no longer enough once non-human identities become the dominant identity class. The article points to a structural mismatch: teams still report on actions completed, while the real risk sits in who or what retains access, for how long, and to which systems. That is a governance problem, not a visibility problem. The implication is that identity programmes must treat entitlement risk as the primary metric, not administrative throughput.

Non-human identity growth breaks human-centric review assumptions. Access review models were designed for identities that move through predictable joiner-mover-leaver cycles. That assumption weakens when service accounts, tokens, and AI agents are created, reused, and retired at machine speed across connected platforms. The implication is that recertification alone cannot carry the governance burden for non-human access.

Continuous evaluation is becoming the operating model for modern identity control. The article aligns with Zero Trust Architecture in a practical sense: access decisions must be re-evaluated as context changes, not only after a period ends. For NHI programmes, that means ownership, entitlement scope, and session-level behaviour matter together. The implication is that governance must move from periodic assurance to ongoing control.

Ephemeral access visibility gap: The most important failure mode is not that organisations cannot see every non-human identity, but that they cannot reliably govern identities whose useful life is shorter than a review cycle. That creates a blind spot between provisioning and certification. The implication is that NHI governance has to measure whether access can be justified at issuance time, not only after the fact.

Identity security now sits at the centre of the wider control stack. When non-human identities outnumber humans by such a large margin, IAM, IGA, PAM, and workload identity controls stop being separate disciplines and become one governance chain. That is why operational accountability, entitlement design, and Zero Trust evaluation have to be planned together. The implication is that identity strategy must be built around actor type, not around one-size-fits-all process design.

From our research library:

• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs — Why NHI Security Matters Now

What this signals

Ephemeral access visibility gap: When non-human identities and AI agents outnumber humans, the core governance challenge is not discovery alone but the speed at which access becomes stale. Programmes that still depend on periodic reviews will continue to miss risk that is created and consumed between checkpoints.

The reader-facing implication is straightforward: IAM and IGA teams need to shift from counting identities and approvals to proving ownership, purpose, and continuous authorisation. That is where identity governance starts to look more like runtime control than administrative oversight.

For practitioners

• Define risk-based identity metrics Replace activity counts on executive dashboards with metrics that show entitlement risk, ownership completeness, and stale access across non-human identities.
• Inventory and assign owners to every non-human identity Create a complete register of service accounts, tokens, certificates, and AI agent identities, then assign a named business and technical owner to each one.
• Apply continuous access evaluation Use Zero Trust policy checks to reassess machine and agent access as context changes, instead of relying only on periodic recertification.
• Tie access rights to lifecycle events Ensure provisioning, rotation, revocation, and offboarding are linked to system ownership and change management so non-human access does not outlive its purpose.
• Separate reporting from assurance Treat activity reports as operational telemetry, not evidence of governance, and verify whether the underlying identities are still authorised for current use.

Key takeaways

• Identity governance is shifting because non-human identities and AI agents are now large enough in number to change how access must be controlled.
• The article’s central warning is that activity-based measurement can hide entitlement risk, especially when machine identities scale faster than review processes.
• Practitioners need to connect ownership, lifecycle management, and continuous evaluation so non-human access is governed at the point of use, not only at review time.

Key terms

• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Continuous Access Evaluation: Continuous access evaluation is the practice of rechecking whether a principal should still have access after the session begins. In NHI environments, it matters because tokens and service accounts can remain valid while the surrounding risk changes, so enforcement has to follow the request, not just the login.
• Entitlement Risk: The likelihood that a specific access right, role, or permission combination will create security, compliance, or fraud exposure. In practice, entitlement risk rises when access accumulates faster than teams can review, certify, or revoke it, especially in hybrid environments with many identity types.
• Identity Ownership: Identity ownership is the assignment of a responsible human for each identity's purpose, access, review, and retirement. For non-human identities, ownership must be explicit because the creator is not always the right person to approve ongoing access. Without ownership, review and revocation become inconsistent and slow.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.