TL;DR: Identity governance still fails where applications, service accounts, machine identities, and AI agents sit outside the governed layer, leaving organizations with incomplete visibility into who and what can access critical systems, according to Orchid Security. The real issue is not governance depth, but governance coverage: access that cannot be seen cannot be certified or controlled.
At a glance
What this is: This is a governance analysis of why IGA still misses hidden identities inside applications, leaving access relationships outside certification and control.
Why it matters: It matters because IAM and IGA teams cannot govern what they have not discovered, and that blind spot now extends across NHI, workload, and agent access paths.
Context
Identity governance breaks down when applications contain accounts, credentials and permissions that never enter the governed layer. In practice, that means IGA can be strong on known identities while still leaving a material share of the estate outside certification, review and policy enforcement.
The problem is not limited to human users. The same coverage gap now applies to service accounts, machine identities and AI agents that authenticate through application-specific access paths. For IAM and IGA teams, the question is no longer whether governance exists, but whether the governed universe is complete enough to matter.
Key questions
Q: What breaks when machine identities are left outside IGA?
A: Governance becomes incomplete because the identities with the least visibility often retain the most persistent access. That creates hidden privilege, weak offboarding, and poor accountability when access needs to be explained to auditors or security teams. The result is a control gap, not just an administrative inconvenience, and it tends to grow over time.
Q: Why do service accounts and machine identities matter under NIS2?
A: Service accounts and machine identities matter because they often carry the permissions that move data, trigger reports, and feed AI workflows. If those identities are over-privileged or left out of review cycles, the organisation cannot prove that access is proportionate or necessary. Under NIS2, that creates both security exposure and audit weakness.
Q: How can security teams tell whether IGA coverage is actually complete?
A: They should compare the number of applications in governance workflows with the number of applications found through discovery and network evidence. If those counts diverge materially, the programme is only covering the visible layer. Completeness, not process activity, is the real success measure.
Q: How should organizations manage credentials for AI agents?
A: Organizations should transition from hard-coded credentials to runtime-fetched credentials that enhance security by ensuring that tokens are not stored permanently. Utilizing solutions like the MCP Secret Wrapper can help eliminate the risks associated with static credentials.
Technical breakdown
Why application discovery is the control boundary for IGA
IGA depends on inventory first: if an application is not onboarded or understood, its internal accounts, roles and access relationships remain invisible to governance workflows. That is why coverage is a prerequisite to lifecycle management, certifications and policy enforcement. Application discovery exposes how identity is actually implemented inside the system, rather than how it is documented in a spreadsheet or questionnaire. In mixed estates, that discovery layer becomes the only way to surface hidden privileges before they harden into unmanaged access paths.
Practical implication: Map application discovery directly to governance onboarding so hidden identities are not excluded from certification cycles.
How service accounts and machine identities evade traditional governance
Traditional IGA was built around identities that are explicitly provisioned, reviewed and recertified. Service accounts, API credentials and machine identities often live outside that model because they are created inside applications, reused across systems, or managed by teams that never pass them into central IAM. The result is not merely poor inventory. It is a structural blind spot where access exists but has no governance record. Once that happens, lifecycle controls can only operate on part of the estate, which weakens the trustworthiness of every attestation downstream.
Practical implication: Extend identity inventory and ownership to non-human credentials before relying on access reviews or certification outputs.
Why AI agents intensify the coverage problem
AI agents complicate governance because they can authenticate with service accounts, inherit user permissions or hold API credentials while operating through access paths that were never modeled as a separate identity type. The issue is not whether the agent is sophisticated. The issue is that its access may be spread across multiple identity constructs, each with different ownership and control expectations. When those paths are not surfaced together, IGA certifies fragments instead of the effective access the agent can exercise. That leaves governance with a partial picture of a single operational actor.
Practical implication: Treat agent access as a composite governance problem and trace every credential and entitlement the agent can invoke.
Breaches seen in the wild
- Internet Archive breach 2024: An exposed GitLab token opened Internet Archive code and 31 million user records; unrotated Zendesk tokens let the attacker back in weeks later.
- Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Governance coverage is now the limiting control, not governance maturity. Many IGA programmes have improved lifecycle workflows, certification cadence and policy automation, but those controls only work on identities that are already inside scope. The gap is not abstract. It is the difference between managing known identities and ignoring the access that applications quietly maintain for themselves. Practitioners should measure governance completeness before they measure governance sophistication.
Hidden identities create an ungoverned access class inside otherwise mature environments. Local accounts, service accounts, machine identities and inherited acquisition accounts do not fail because they are rare. They fail because ownership, inventory and onboarding are fragmented across teams and systems. Once access is outside the governed layer, certification becomes a ritual applied to an incomplete dataset. The practitioner conclusion is that completeness must be treated as a control objective in its own right.
Application reality has become the new identity perimeter. Identity no longer lives only in the directory, IdP or PAM layer. It lives inside applications, APIs and workload execution paths where central governance often has no direct line of sight. That changes the governance problem from reviewing access to discovering the identities that should have been reviewed in the first place. Teams need to govern where identity is implemented, not only where it is centralised.
Coverage gaps now span human, machine and agent identity in one control plane. This is what makes the topic broader than legacy IGA. Human users still matter, but they are no longer the edge case. The more serious failure mode is when service accounts, workload identities and AI agents sit outside the same governance universe, producing inconsistent ownership and weak attestation quality. Practitioners should align governance scope to the full identity estate, not just the directory view.
Identity blast radius is defined by what governance cannot see. That is the named concept this article sharpens. If an identity, credential or access path is invisible to IGA, it effectively sits outside review, recertification and exception handling, even if it is operationally critical. The implication for the field is that visibility and governance are now the same problem at different layers, and partial visibility is partial control.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
What this signals
Identity blast radius: The practical question is no longer how strong the governance workflow is, but how much of the identity estate actually enters it. When applications hold local accounts, service identities and delegated access outside the governed layer, the effective blast radius is determined by visibility gaps rather than policy strength.
Coverage-first governance is becoming the baseline expectation for IAM and IGA programmes that now span human users, workloads and AI agents. Teams that still treat application onboarding as separate from identity discovery will continue to certify an incomplete picture, which weakens both audit confidence and operational control.
For practitioners
- Expand the governed identity inventory Build a discovery process that finds application-local accounts, service accounts, privileged identities, API credentials and machine identities before review cycles begin.
- Tie onboarding to governance scope Make application onboarding the trigger for identity discovery, ownership assignment and certification coverage, so unmanaged systems do not stay outside the IGA layer.
- Trace non-human access paths end to end Record how workloads and AI agents authenticate, what credentials they use, and which permissions they inherit from users or service accounts.
- Measure coverage before maturity Report the share of applications, accounts and access paths that are actually governed, not just the count of completed reviews.
- Assign ownership for inherited identities Require clear business and technical owners for identities introduced through acquisitions, shadow IT or application sprawl, then recertify them into scope.
Key takeaways
- IGA programmes can be sophisticated and still miss identities that never enter the governed layer.
- Hidden application accounts, service identities and machine credentials create a coverage problem, not just a reporting problem.
- The control question is whether every meaningful access path is discoverable, owned and eligible for certification.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Hidden identities and unmanaged application accounts stay outside governance when they are never onboarded or retired properly. |
| NHI-03 — Vulnerable Third-Party NHI | Inherited identities from acquisitions and external applications often remain outside the central governance boundary. | |
| NHI-05 — Overprivileged NHI | Governance blind spots make excessive permissions harder to see and recertify across service and machine identities. | |
| Recommendation — Map unmanaged application identities to NHI-01 and close offboarding gaps that leave accounts outside governance. Review third-party and acquired application identities against NHI-03 before certifying access. Audit non-human access scopes for NHI-05 and remove privileges that are not explicitly governed. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about incomplete visibility into permissions and entitlements across the identity estate. |
| Recommendation — Use PR.AA-05 to ensure permissions and entitlements are inventoried before recertification starts. | ||
| CIS Controls v8 | CIS-5 — Account Management | Hidden application identities are an account management failure when ownership and lifecycle are unclear. |
| Recommendation — Apply CIS-5 to maintain an authoritative account inventory across applications and non-human identities. | ||
| MITRE ATT&CK | TA0007;TA0006 — Discovery; Credential Access | Attackers benefit when hidden identities and credentials remain undiscovered inside applications. |
| Recommendation — Hunt for undiscovered identities under TA0007 and credential exposure under TA0006 in application estates. | ||
Key terms
- Identity Coverage: The portion of an organisation’s application and account estate that is actually reachable by central identity controls. For disconnected environments, coverage is not just about count or inventory. It is about whether policy, lifecycle, and verification can be enforced end to end.
- Communication-layer identity: The practice of proving identity at the moment of a message, request, or approval, rather than only at login. It extends identity assurance into collaboration tools, workflows, and APIs so that internal-looking actions can be verified for provenance, integrity, and accountability.
- Governed universe: The set of identities, access paths and permissions that an organisation has successfully brought under formal governance. In practice, this is the boundary between what can be reviewed and controlled and what remains operationally real but administratively invisible.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 24, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org