NHI access review campaigns expose the governance gap in IAM

At a glance

What this is: This is an analysis of why human-style access review campaigns leave non-human identities outside IAM governance and how campaign-based review can close that gap.

Why it matters: IAM, IGA, and PAM teams need a way to review service accounts, API keys, and machine tokens with ownership and auditability, not just human-centric certification workflows.

Context

Access review campaigns are a governance mechanism for certifying who or what still needs access, but most programmes were designed around human managers, HR records, and reviewer queues. That model breaks when the subject is a service account, API key, or machine token that has no obvious manager and no HR lifecycle.

For non-human identities, the core problem is accountability, not just review cadence. If ownership sits in Slack threads, spreadsheets, or tribal knowledge, the organisation cannot reliably decide whether to rotate, disable, or reassign access before the next audit or incident.

Entro Security argues that campaign-based review can extend IAM discipline to NHIs by making scope, ownership, actions, and audit trails explicit. The underlying gap is typical across enterprises that have grown machine credentials faster than governance processes.

Key questions

Q: What breaks when access review does not cover non-human identities used by AI agents?

A: When access review ignores the NHIs behind AI agents, organisations lose visibility into stale privileges, inherited rights, and abandoned credentials that still allow action. That creates an audit gap and a control gap at the same time. The access path may still work even when no one can explain why it should.

Q: Why do NHIs need separate access review campaigns instead of human recertification workflows?

A: NHIs need separate campaigns because their access is often tied to systems, teams, or pipelines rather than employees. That changes who can approve changes, who should be notified, and what evidence proves action. A machine identity review must therefore track remediation state and owner response, not just reviewer certification.

Q: How do security teams know if NHI controls are actually working?

A: Look for complete inventory coverage, clear ownership, enforced rotation, and evidence that unused credentials are removed on time. If secrets remain active after changes to applications, vendors, or pipelines, the control is not working. Monitoring should also show whether machine access stays within the expected workload scope.

Q: What should teams do after an NHI review finds an orphaned or high-risk credential?

A: Treat the finding as a lifecycle event, not a ticket. The next step is to assign or confirm ownership, decide whether the credential should be rotated or disabled, and record the outcome in the identity record. If the owner cannot be identified, escalation should follow the same path as any other unresolved governance exception.

How it works in practice

Why human access reviews do not map to NHIs

Human access reviews assume a manager, an HR event, and a stable reviewer relationship. Non-human identities rarely have any of those anchors. A service account may be owned by a team, an application, or nobody at all, while an API key can be embedded in tooling without a clear business owner. That means certification logic built for people cannot determine accountability, and revocation decisions become manual investigations instead of governed workflow. The technical issue is not just scale, but identity metadata quality and ownership resolution across disparate systems.

Practical implication: identify where your certification workflow depends on human attributes that NHIs do not have, then redesign ownership data before you rely on review results.

Risk-based scoping for service accounts, API keys, and machine tokens

Campaigns work when the scope is specific enough to produce action. For NHIs, that usually means grouping identities by risk signals such as idle credentials, non-expiring secrets, exposed credentials, over-permissioned accounts, or former-employee linkage. This is fundamentally different from bulk recertification because the review target is a control problem, not just a population. A risk-based scope lets teams prioritise identities whose privileges, exposure, or usage patterns make them more likely to warrant rotation, disablement, or ownership reassignment.

Practical implication: build campaigns around measurable NHI risk patterns, not broad identity inventories that produce review fatigue and weak decisions.

Audit trails and remediation state are the real control outcome

A review campaign is only useful if every action leaves an evidence trail. For NHIs, that means recording whether the identity was rotated, disabled, approved, or reassigned, and whether the owner or admin completed the action. Without that state, the organisation cannot prove governance to auditors or determine what remains exposed. The deeper architectural value is that campaign state becomes a lifecycle record for machine identities, which are otherwise easy to lose across clouds, SaaS tools, and CI/CD systems.

Practical implication: make campaign status and remediation logging part of the identity record so governance survives beyond the review event.

NHI Mgmt Group analysis

NHI access review campaigns expose an ownership gap, not just a process gap. Human-centric IAM assumes every identity can be routed through a manager and a reviewer. NHIs break that assumption because the accountable party is often an application team, platform owner, or no one at all. The implication is that certification for non-human access must start with ownership resolution, not with the review task itself.

Campaign-based review turns NHI governance from reactive cleanup into structured lifecycle control. When service accounts and machine tokens are only discovered after audits or incidents, the organisation is already governing by exception. A campaign model forces scope, decision, and remediation into one workflow, which is the right direction for OWASP-NHI improper offboarding, secret leakage, and overprivileged NHI risk.

Access review is now a control plane for machine identity hygiene. The value is not the review ceremony but the ability to decide, log, and evidence what happens to each non-human credential. That aligns NHI governance with broader identity lifecycle discipline and makes orphaned, idle, and non-expiring credentials visible as governance defects rather than hidden technical debt.

Remediation state is the named concept that matters here: review without action is not governance. If a campaign cannot show who acted, what changed, and what remains pending, the process is only documentation. For NHIs, that distinction is decisive because unresolved credentials can keep running long after the reviewer closes the ticket.

IAM teams should treat NHI reviews as a prerequisite for broader autonomy and workload governance. The same accountability problems that surface in service-account campaigns will intensify as agentic systems and workload identities spread. Establishing structured review now gives identity teams a repeatable model for non-human lifecycle control across the full machine estate.

From our research library:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Read next: Top 10 NHI Issues

What this signals

Remediation state is the control point that separates review theatre from governance. If teams cannot show who acted on a service account, API key, or machine token, the campaign has not reduced risk. That is why NHI programmes need identity records that persist beyond the review cycle and carry status, ownership, and action history into the next governance decision.

Campaigns expose where IAM programmes still depend on human assumptions. The review model works only when identity ownership, approval rights, and evidence collection are explicit. For NHIs, that means shifting from reactive discovery to structured lifecycle governance across clouds, SaaS tools, and CI/CD pipelines.

For practitioners

• Define NHI ownership before launching campaigns Map each service account, API key, and machine token to a named business or technical owner before review begins. If ownership cannot be assigned, treat the identity as a governance exception and route it for remediation rather than certification.
• Scope campaigns by explicit NHI risk patterns Use filters for orphaned identities, idle credentials, exposed secrets, non-expiring tokens, former-employee links, and overprivileged access. Risk-based scoping keeps review effort focused on identities that are most likely to need rotation, disablement, or ownership reassignment.
• Give admins first-pass remediation authority Allow administrators to rotate, disable, approve, or reassign NHIs before owner review so that obvious fixes do not wait for manual approval loops. Pair each action with provider-specific steps and a complete checklist so the campaign produces real change.
• Log campaign outcomes as lifecycle evidence Persist Pending, Awaiting Action, and Remediated states with timestamps, actor names, and the exact change made. That record becomes the audit trail for NHI governance and shows whether a review campaign closed the loop or only identified the gap.

Key takeaways

• NHI access reviews fail when IAM assumes every identity has a manager, a reviewer, and an HR lifecycle.
• The operational gap is ownership and evidence, not just review cadence, because machine credentials often outlive the people who know they exist.
• Campaign-based governance can reduce hidden NHI risk when it ties scope, remediation, and audit logging into one controlled workflow.

Key terms

• Non-Human Identity Access Review: A Non-Human Identity Access Review is a formal check of what machine identities can access and whether that access is still needed. It examines service accounts, API keys, tokens, certificates, and agent permissions against current business purpose, ownership, and risk, then identifies excess, stale, or unapproved access for correction.
• NHI ownership resolution: The process of identifying who is accountable for a machine identity when no obvious manager exists. It links technical credentials to a business or platform owner so review, approval, and remediation can happen without relying on tribal knowledge or Slack archaeology.
• Remediation Status: Remediation status describes whether a security tool has already quarantined, deleted, or otherwise contained the detected threat. It is a critical triage input because it tells analysts whether the event is still active, partially contained, or already neutralised on the affected host.
• Orphaned NHI: An orphaned NHI is a non-human identity that remains active without a clear owner, business purpose, or lifecycle path. These identities often survive employee departures, application changes, or missed deprovisioning steps, which makes them difficult to review and risky to leave in place.

Deepen your knowledge

NHI governance, identity lifecycle management, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or governance programme, it is worth exploring.