TL;DR: The NHI 2x2 framework argues that mature non-human identity programmes must connect visibility, intelligence, management, and remediation across service accounts, service principals, certificates, and API tokens, according to Veza. The practical shift is from inventorying identities to proving that fixes reduce blast radius and stay fixed.
At a glance
What this is: This is an analysis of the NHI 2x2 framework, which says non-human identity programmes need a closed loop from visibility to verified remediation across the identity types that run modern environments.
Why it matters: It matters because IAM teams cannot govern service accounts, service principals, certificates, and API tokens with inventory alone; they need effective access, ownership, and proof that remediation actually changes risk.
Context
Non-human identity governance fails when teams can list identities but cannot resolve effective permissions, ownership, and downstream data reach. In practice, the problem is not missing inventory alone; it is the gap between seeing an NHI and proving that a change has reduced its blast radius across cloud, SaaS, data, and on-prem environments.
Veza frames the answer as a 2x2 operating model: four motions on one axis and four NHI types on the other. The model is meant to keep each identity family moving from visibility to remediation without breaking builds or trust, which is a more operational standard than static discovery or periodic review.
For IAM and security teams, the important shift is governance at the point of change. That means ownership, TTLs, scopes, approvals, and verification are treated as part of the identity lifecycle, not as separate clean-up tasks after an audit or incident.
Key questions
Q: Where does NHI governance fail when teams only track identity inventory?
A: It fails when inventory is mistaken for control. A list of service accounts, principals, certificates, and tokens does not show effective access, ownership, or whether a change actually reduced blast radius. Mature governance requires resolved permissions and verified remediation, otherwise the programme can describe exposure without shrinking it.
Q: Why do service accounts and API tokens make application exploits worse?
A: Service accounts and API tokens extend a host compromise into other systems because they carry machine authority beyond the vulnerable process. If those identities are overprivileged or long-lived, the attacker can pivot from code execution to persistence, data access, or cloud control. NHI governance is therefore part of incident containment.
Q: What signs show that NHI remediation is not actually closing risk?
A: The clearest sign is when teams can prove that a task was completed but cannot prove that access changed. If dormant accounts remain active, scopes still reach sensitive data, or revoked consents continue to work downstream, then remediation has not closed the loop. Verification must be part of the control, not an afterthought.
A: They should map each NHI type to its dominant failure mode. Certificates need issuer, renewal, and impersonation controls. Service principals need consent and scope governance. API tokens need TTLs, naming discipline, and kill switches. The programme should share a lifecycle model, but the control design must differ by identity type.
Technical breakdown
Why effective access, not role names, is the real NHI control surface
A role list rarely shows who can actually do what with an NHI. Effective access resolves inheritance, nested groups, OAuth scopes, indirect data paths, and change rights into a usable picture of privilege. That matters because service accounts and service principals often inherit more than their labels suggest, while certificates and API tokens can impersonate systems that hold far broader access than the issuing object appears to have. The control problem is therefore not visibility in the abstract. It is whether teams can explain current authority across systems well enough to reduce privilege safely.
Practical implication: build governance around effective permissions, not identity labels or isolated role assignments.
How the four motions create a closed-loop NHI operating model
Visibility, intelligence, management, and remediation are not separate projects. Visibility creates a normalized inventory with owners, usage, and reachable data. Intelligence ranks what matters by blast radius and sensitivity. Management turns intent into defaults such as least privilege, TTLs, and approvals. Remediation then retires, downgrades, revokes, or rotates access and confirms the state actually changed. The technical value of the loop is that it prevents drift from reappearing after the clean-up step. Without verification, remediation is just temporary hygiene; with verification, it becomes governed change.
Practical implication: treat remediation as a verified state change, not a ticket closure event.
Why service accounts, service principals, certificates, and API tokens need different controls
The article’s value is that each NHI type fails differently. Service accounts tend to accumulate dormant privilege and interactive use that should never exist. Service principals grow through consent, secrets, certificates, and cross-tenant paths. Certificates look tidy but can hide impersonation and trust issues through SAN reuse or weak crypto. API tokens are often over-scoped, long-lived, and spread across CI/CD, chatbots, vendor portals, and data tools. A mature programme therefore maps each identity type to the specific governance action that closes its dominant failure mode.
Practical implication: tune controls by NHI type instead of applying one generic lifecycle process to everything.
Threat narrative
Attacker objective: The attacker objective is to turn legitimate-looking machine access into durable control over sensitive systems, data, or identity paths without triggering obvious anomaly signals.
- Entry occurs when a service token, certificate, or delegated principal grants normal machine access that nobody treats as suspicious because it looks like routine operations.
- Escalation follows when inherited permissions, wildcard scopes, or dormant memberships extend that access into production data, identity controls, or admin paths.
- Impact appears when the NHI writes to production, leaks an admin-scoped token from a build system, or enables cross-environment access that stays active long enough to matter.
Breaches seen in the wild
- Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Closed-loop NHI governance is now the baseline, not an advanced maturity state. Inventory without verified remediation still leaves organisations unable to prove that risk has fallen. The article’s 2x2 is best read as a governance operating system for service accounts, service principals, certificates, and API tokens. The practitioner implication is clear: if a programme cannot show ownership, effective access, and post-change validation, it does not yet govern NHI risk.
Effective access is the named concept that matters more than directory labels. The article is explicit that role names, last-used status, and asset counts are insufficient on their own. What matters is who can take what action on what data across inheritance, scopes, and indirect paths. That reframes NHI work from cataloguing objects to measuring actual reach, which is the only version that supports meaningful blast-radius reduction.
Service accounts, service principals, certificates, and tokens must be governed as different risk surfaces. The article’s strongest operational insight is that each vector fails in a different way, so remediation must differ too. Service accounts need dormant privilege removal, service principals need consent and scope control, certificates need impersonation and renewal governance, and tokens need TTL and kill-switch discipline. Practitioners should stop treating them as one undifferentiated workload identity problem.
Visibility plus intelligence only matter when management and remediation are enforced together. A programme can know where privilege exists and still fail if it cannot standardise creation, require approvals, and verify cutover after change. That is why this framework is more useful than a discovery-only model. The implication for teams is to measure closure, not coverage, because exposed identities that are merely found but not fixed still define the real risk surface.
NHI blast radius is the right outcome metric for identity security teams. The article repeatedly ties successful governance to reduced reachable data, fewer privileged paths, and verified state change. That makes blast radius the most defensible executive measure of whether a programme is working. The practitioner implication is to prioritise fixes that shrink reachable impact, not fixes that only improve the inventory report.
From our research library:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Read next: Ultimate Guide to NHIs — Key Challenges and Risks
What this signals
Effective access should replace static inventory as the operating metric. Teams that can only count NHIs are still blind to the permissions those identities inherit or consume. The programme signal to watch is whether every identity change ends with a verified reduction in reachable data and privileged paths, not just a cleaner catalogue.
Closed-loop governance is the real test of NHI maturity. Discovery, ranking, change, and verification need to function as one control chain or drift will return immediately after cleanup. For teams building programme roadmaps, that means prioritising lifecycle enforcement and post-change evidence over one-time audits.
The ratio of non-human to human identities now exceeds 100:1 in the average enterprise, according to the Ultimate Guide to NHIs. That scale makes manual review structurally inadequate and pushes ownership, TTLs, and automated verification to the front of the agenda.
For practitioners
- Define effective access for every NHI Resolve inherited permissions, nested groups, OAuth scopes, and indirect data paths so each identity has a current, usable access picture.
- Attach ownership and lifecycle metadata Require owner, purpose, environment, TTL, and rotation policy on service accounts, principals, certificates, and tokens at creation time.
- Rank remediation by blast radius Prioritise identities that can reach production, sensitive data, or identity-control paths even when they appear low-risk in directory listings.
- Verify every downgrade or revoke Confirm that scope reduction, consent revocation, retirement, or rotation actually changed downstream access before closing the change.
- Automate dormant identity cleanup Remove unused memberships, retire inactive service accounts, and rotate or revoke long-lived tokens and certificates on a governed schedule.
Key takeaways
- The article argues that NHI governance breaks down when teams can inventory identities but cannot prove effective access or verified remediation.
- Its central operating model ties visibility, intelligence, management, and remediation across the identity types that actually run enterprise environments.
- The practical control shift is from cataloguing non-human identities to demonstrating that fixes reduce blast radius and stay fixed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centers on excessive effective access across service accounts, principals, certificates, and tokens. |
| NHI-01 — Improper Offboarding | The remediation loop depends on retiring dormant accounts and revoking access when identities outlive their purpose. | |
| NHI-07 — Long-Lived Secrets | API tokens and certificates are treated as lifecycle-managed credentials that should not persist indefinitely. | |
| Recommendation — Reduce standing reach by mapping each NHI to the minimum permissions it actually needs. Remove inactive or no-longer-needed NHIs and confirm their downstream access is gone. Set expiry and rotation policies for machine credentials that should not remain valid indefinitely. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The framework depends on governing actual entitlements and authorizations, not just identity labels. |
| Recommendation — Continuously review and adjust entitlements so effective access matches current business need. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Tokens, secrets, and certificates require lifecycle management, rotation, and revocation discipline. |
| Recommendation — Manage authenticators with rotation, expiry, and revocation controls tied to their operational use. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article describes how machine credentials expand reach and enable movement across environments. |
| Recommendation — Map exposed machine credentials to credential access and lateral movement paths in detection and response. | ||
Key terms
- Effective Access: The actual permissions an identity can exercise after inheritance, nested groups, delegation, and object-level controls are evaluated. In Active Directory, effective access is more useful than direct membership because it reveals the true operational reach of a service account.
- Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
- Closed-Loop Remediation: A governance process that does not stop at finding risk. It removes or reduces access, confirms the change in the source systems, and keeps evidence that the risky condition stayed fixed. For NHIs, this is the difference between inventory and actual risk reduction.
- Non-Human Identity Lifecycle: The Non-Human Identity Lifecycle is the full sequence of creation, use, control, review, and retirement for identities that are not tied to a person. It covers service accounts, API keys, certificates, tokens, bots, and AI agents, including issuance, rotation, monitoring, revocation, and secure decommissioning across systems and environments.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on May 28, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org