NHI governance is becoming a runtime control problem for AI agents

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Securden's blog post: NHI governance has moved beyond discovery and vaulting, because AI agents and other machine identities now need runtime control, ownership, and lifecycle enforcement.

Why it matters: It matters because IAM and IGA programmes built around human workflows miss how service accounts, tokens, and AI agents create persistent or expanding access paths that must be governed at execution time.

By the numbers:

• For every human employee who logged into systems this morning, roughly 82 non-human identities did the same behind the scenes.
• The 2025 Identity Security Landscape report surveyed 2,600 security decision-makers across 20 countries.
• Secrets tied specifically to AI services jumped 81% in the same period.

Context

Non-human identity governance is the discipline for controlling service accounts, tokens, keys, certificates, workloads, and AI agents that authenticate without a person at the keyboard. This article argues that the operating model for those identities has changed faster than most IAM programmes can track, especially when runtime behaviour determines blast radius.

The article's core claim is that inventory alone is no longer enough. Once an identity can decide which action to take next, governance has to move from static registration to policy enforcement, lifecycle ownership, and execution-time controls.

That shift is typical of mature cloud and SaaS environments rather than a niche edge case. The ratio of machine activity to human activity is now high enough that NHI oversight becomes a core security operating model, not a cleanup task.

Key questions

Q: What breaks when non-human identities are managed only through inventory and quarterly review?

A: Ownership and exposure drift faster than the review cycle. Service accounts, API keys, and agent credentials can remain active long after the business need changes, so the control fails at the point where access should have been revoked or bounded. In practice, the missing control is lifecycle enforcement tied to the credential itself.

Q: Why do AI agents increase breach impact when they use NHI credentials?

A: Because the credential does not just identify the agent, it authorises a machine-speed path across systems. Once a service account, token, or API key is reused in CI/CD, cloud, or tool orchestration, the attacker or malicious agent can propagate trust faster than perimeter controls can react. The impact is broader lateral movement and faster exfiltration.

Q: How can organisations tell whether their NHI controls are actually working?

A: Look for reduced secret sprawl, fewer long-lived credentials, clear ownership records, and rapid offboarding when workloads are retired. If teams cannot account for where secrets live or whether they still work, the control programme is failing. Good NHI governance produces traceable access decisions, not just more tooling.

Q: Should organisations prioritise runtime policy for agents over more secret storage?

A: Yes, when the main problem is what an identity can do after it authenticates. Secret storage reduces exposure, but runtime policy limits blast radius when an agent, integration, or pipeline can still make consequential decisions mid-session. The order matters when action, not just possession, drives risk.

Technical breakdown

Why NHI inventory no longer tells you enough

Inventory shows that a non-human identity exists, but not whether it still has valid ownership, standing privilege, or an operational purpose. In modern environments, the same service account may be linked to CI/CD, SaaS integrations, cloud roles, and agent workflows. That creates a control problem because the asset graph matters as much as the credential itself. If you only count identities, you miss relationships that create implicit trust and persistent access. Practical NHI governance needs ownership mapping, entitlement context, and expiry logic, not just a registry.

Practical implication: build identity inventory around ownership and access relationships, not just object count.

Why AI agents change the control model

AI agents are not just another workload credential because they can select actions at runtime. A service account repeats a narrow task, but an agent can chain tools and expand scope depending on what it is allowed to touch. That means blast radius is determined by the policy boundary around the agent, not by the fact that its secret exists. This is why access reviews alone are too slow: they assume a stable privilege state, while agent behaviour can change inside the same session. Runtime policy enforcement becomes the primary control plane.

Practical implication: move agent governance from periodic review to runtime policy enforcement and scoped tool access.

Why standing credentials keep defeating governance

Long-lived API keys, OAuth tokens, and other static secrets create durable trust even when the original business need has changed. Once these credentials appear in code, pipelines, or third-party integrations, they can survive long after the person or team that created them has moved on. That is why lifecycle failure matters as much as exposure. The technical issue is not only leakage, but persistence without offboarding, revocation, or ownership transfer. In NHI programmes, the credential lifecycle is the attack surface.

Practical implication: treat secret lifecycle and offboarding as first-class controls, not cleanup tasks.

Threat narrative

Attacker objective: The attacker aims to turn unmanaged non-human access into durable control over production systems, secrets, or downstream customer data.

1. Entry occurs when a third-party AI tool or exposed token provides access to production systems, rather than through a human login.
2. Credential access follows when long-lived API keys, OAuth tokens, or CI/CD secrets are available outside governed storage.
3. Escalation happens when the identity can reach environment variables, cloud resources, or additional tools beyond its original purpose.
4. Impact is wider blast radius, unauthorized system access, and compromised customer or production data without a human approval gate intervening.

Breaches seen in the wild

• reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.
• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime control, not inventory count, is now the governing question for NHI programmes. Discovery still matters, but it no longer solves the core problem once identities can act, chain tools, and touch live systems. The field has moved from asking whether an identity exists to whether its actions can be constrained while it is in motion. Practitioners should treat runtime enforcement as the decisive control boundary.

AI agents create a governance failure mode that service accounts never introduced. The reason is simple: a service account executes a predetermined task, while an agent can choose among actions inside a permitted scope. That means the control assumption that access can be safely reviewed after the fact is weaker than it looks. The implication is a different operating model for entitlement design, with policy attached to execution rather than just issuance.

Ephemeral credential trust debt: Static secrets accumulate hidden obligations because every leaked token, orphaned role, or stale integration expands the trust surface long after business ownership has moved on. This is not just an exposure problem, it is a governance debt problem created by delayed offboarding and incomplete accountability. NHI programmes that do not model this debt will keep discovering the same identities in different incident reports. Practitioners need lifecycle ownership that follows the credential, not the team.

The human-to-machine ratio exposes a mismatch between IAM process design and real operating conditions. Human lifecycle assumptions still shape many control programmes, but machine identities now outnumber users by a wide margin in active environments. That changes what maturity looks like: not more review meetings, but stronger ownership graphs, expiry enforcement, and agent runtime constraints. The discipline is becoming a core security operating model, not a specialist add-on.

Access review cadence is too slow for identities that can create or discard privilege during execution. This is where NHI and autonomous-style behaviour start to blur operationally, even when the actor is not fully autonomous. If the identity can expand its effective reach during a task, then certification after the task is already too late to limit harm. Practitioners should re-evaluate which controls are tied to creation time, review time, or runtime time.

From our research library:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs

What this signals

Runtime policy will become the separating line between mature NHI programmes and those that only catalog identities. Once agents and machine identities can make consequential choices during a session, the programme has to govern execution, not just registration. That is a control design issue, not a tooling preference.

Access reviews remain necessary, but they are no longer sufficient for machine and agent identities. The practical shift is toward continuous ownership, expiry, and revocation logic that operates before a token or agent action can widen blast radius. Teams should expect more of the control stack to move left in the lifecycle and closer to issuance time.

Ephemeral credential trust debt will be the next operational blind spot for many IAM teams. Credentials that are technically short-lived but functionally reusable across tools or vendors still accumulate hidden exposure, so lifecycle governance has to follow the trust relationship as well as the token itself.

For practitioners

• Map every non-human identity to a named owner Tie service accounts, tokens, roles, and agents to a business owner and a technical custodian so no credential can exist without accountability.
• Replace standing access with time-bound issuance Use just-in-time access for credentials that only need to exist during a task, especially where an integration or agent touches production data.
• Separate agent permissions from human role models Define explicit tool and data scopes for AI agents instead of inheriting broad human entitlements that were never intended for runtime decision-making.
• Automate offboarding of orphaned secrets Continuously detect credentials that survive project changes, team moves, or vendor relationships, then revoke them before they become reusable trust.
• Add runtime enforcement to high-blast-radius workflows Insert policy checkpoints where agents, pipelines, or integrations can be stopped or narrowed mid-action when they reach sensitive systems or data.

Key takeaways

• NHI governance is no longer just a discovery problem because machine identities and AI agents now shape active access paths, not just static inventories.
• The article's evidence points to a dense machine-to-human ratio and a large volume of exposed secrets, which together widen the operational blast radius.
• Practitioners need ownership, lifecycle automation, and runtime policy enforcement to govern identities that can outlive projects or change scope mid-session.

Key terms

• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Runtime Policy Enforcement: Runtime policy enforcement evaluates a request at the moment it is executed instead of relying only on preconfigured permissions. For AI agents, this allows decisions to reflect current context, target sensitivity, and behavioural signals rather than static assumptions.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Ephemeral Credentials: Ephemeral credentials are short-lived access artefacts issued for a limited task or session. They reduce the window for abuse, but they only improve security when paired with strong scope limits, telemetry, and automatic revocation at task completion.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.