NHI governance is becoming a runtime control problem for AI agents

At a glance

What this is: NHI sprawl now includes service accounts, secrets, and AI agents, and the key finding is that runtime governance matters more than static inventory.

Why it matters: IAM, IGA, PAM, and cloud security teams need to rework controls for identities that authenticate without a person, persist outside HR lifecycle, and can change effective access during execution.

By the numbers:

• For every human employee who logged into your systems this morning, roughly 82 non-human identities did the same behind the scenes.
• 28.65 million new hardcoded secrets landed on public GitHub in 2025 alone, up 34% year over year.
• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers.

👉 Read Securden's analysis of NHI governance and AI agent access control

Context

Non-human identity security is the discipline that governs service accounts, API keys, tokens, certificates, workload identities, and now AI agents that authenticate without a person at the keyboard. The core problem is not just volume. It is that these identities often persist outside human lifecycle assumptions, making ownership, revocation, and runtime control much harder than standard IAM models expect.

The article argues that the category has expanded faster than most programmes can track, and that is the central governance gap. Once AI agents can chain tools together and act on decisions without human approval at each step, the access model changes from static entitlement management to runtime policy enforcement. That is a materially different control problem for NHI, PAM, and identity architecture teams.

Securden frames this as a single identity control plane problem, but the broader lesson is more general. If teams still treat non-human access as a peripheral security exception, they will miss the point where inventory ends and operational governance begins.

Key questions

Q: What breaks when non-human identity ownership is unclear?

A: When ownership is unclear, rotation stalls, reviews default to approval, and nobody feels safe removing access. That creates orphaned identities, stale credentials, and broad permissions that persist because the organisation cannot prove what depends on them. The result is a growing attack surface with no accountable decision-maker.

Q: Why do AI agents complicate existing IAM and NHI governance models?

A: AI agents complicate governance because access is no longer confined to a single environment or a single identity type. An agent may need cloud runtime permissions, customer data access, and tool-level OAuth tokens at the same time, which means standing privilege and lifecycle assumptions break down fast. That is why one control model rarely covers the full path.

Q: How do security teams know if NHI controls are actually working?

A: Look for complete inventory coverage, clear ownership, enforced rotation, and evidence that unused credentials are removed on time. If secrets remain active after changes to applications, vendors, or pipelines, the control is not working. Monitoring should also show whether machine access stays within the expected workload scope.

Q: Should organisations prioritise vaulting or lifecycle automation for NHI risk?

A: Lifecycle automation should come first when credentials, tokens, and service accounts outlive their useful purpose. Vaulting reduces where secrets are stored, but it does not solve stale access, orphaning, or delayed offboarding. If the identity still exists after the task is over, the real problem remains.

Technical breakdown

What makes AI agents different from ordinary service accounts?

Service accounts normally execute a fixed function with stable permissions. AI agents can reason about which action to take next, which tools to call, and when to proceed, which means their effective blast radius depends on runtime scope rather than just credential possession. That distinction matters because an agent can remain within policy on one step and become risky on the next if the permitted action set is too broad. Traditional access review is not enough when the actor can change its path during execution.

Practical implication: Treat AI agent access as a runtime authorisation problem, not only as an inventory or provisioning problem.

Why standing credentials fail at NHI scale

Standing credentials create a long-lived trust boundary that attackers only need to cross once. In an NHI environment, the problem compounds because keys, tokens, and certificates are often embedded in code, CI/CD, SaaS integrations, or distributed workflows where ownership is unclear and rotation lags behind use. Vaults help with storage, but they do not solve exposure, propagation, or delayed revocation. That is why the article emphasises ephemeral access and automated lifecycle control rather than storage alone.

Practical implication: Reduce the lifetime of privileged machine access and tie revocation to the end of the task, not to a calendar review.

Why inventory alone does not close the governance gap

Discovery tells you what exists. Governance tells you who owns it, what it can reach, and when it should stop existing. The article’s point is that orphaned identities, stale keys, and tribal ownership turn into residual attack paths if decommissioning is not automated. That is especially true when machine identities outlive the project, pipeline, or team that created them. In practice, incomplete ownership mapping is what makes dormant access so difficult to remove.

Practical implication: Build lifecycle controls that connect discovery to ownership, decommissioning, and continuous validation.

Threat narrative

Attacker objective: The objective is to turn one unmanaged non-human identity into wider access, propagation, and credential exposure across production workflows.

1. Entry began through an OAuth-connected third-party AI tool with standing access to production environment variables, giving attackers a route into internal systems.
2. Escalation followed the abuse of exposed developer and CI/CD tokens in supply chain propagation, which allowed the campaign to spread beyond a single foothold.
3. Impact was the exposure of internal systems and a limited subset of customer credentials, showing how dormant machine access can amplify into broader compromise.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity governance is now a runtime discipline, not a periodic review exercise. Once AI agents can choose actions and tools at execution time, the old assumption that access can be certified after the fact breaks down. Access review tells you who had privilege, but not whether the actor’s behaviour stayed within the intended boundary. The practitioner conclusion is simple: governance must move closer to execution.

Ephemeral credential trust debt is the hidden cost of modern NHI sprawl. The problem is not only exposure, but the long tail of valid secrets that continue to work after they were first leaked or overused. That makes revocation latency a first-order risk variable in OWASP-NHI, NIST-CSF, and lifecycle governance terms. Organisations need to treat every unused or long-lived secret as accumulated trust debt.

AI agent blast radius is defined by policy scope, not just secret hygiene. A service account does the same thing every time it runs, but an agent can combine tools, branch execution, and widen the consequences of a single permission. That means the governance question is no longer only whether the credential exists, but what the actor can do once it is live. Teams should rethink authorization boundaries as runtime containment zones.

Ownership is the control that makes NHI governance operational. Discovery without accountable ownership creates a catalogue, not a control. When the engineer who created a credential has moved teams or left the company, stale access becomes invisible until an incident surfaces it. The practitioner implication is that ownership mapping must sit at the centre of lifecycle and access decisioning.

Runtime policy enforcement is the named control concept this category now needs. Static inventory, quarterly review, and vault storage all assume access patterns are predictable enough to be checked later. That assumption no longer holds for AI agents and sprawling machine identities. The field should now measure whether policy can intervene during execution, because that is where modern NHI risk is actually expressed.

From our research:

• 91.6% of secrets remain valid five days after notification, according to Ultimate Guide to NHIs.
• 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
• Use Guide to the Secret Sprawl Challenge to connect secret discovery, rotation, and revocation into one operating model.

What this signals

Ephemeral credential trust debt is the right way to think about this category now. Once a secret can leak, persist, and remain valid long after discovery, the issue is not merely exposure but how much residual trust the programme allows to accumulate. That is why lifecycle automation and revocation speed need to sit alongside inventory. For practitioners, the practical test is whether an identity’s access can be removed as quickly as it can be discovered, not whether it can be listed.

The shift from service accounts to AI agents means identity teams have to evaluate runtime policy boundaries, not only authentication mechanics. If an actor can chain tools and change execution path mid-session, the control model must be able to intervene during action, not after the fact. This is where SLSA and control-plane thinking intersect with NHI governance, because the operational question becomes how much trusted execution a workflow should be allowed to inherit.

Teams should expect more pressure to unify identity, secrets, and workload governance around a shared ownership model. That is the practical lesson from the reported 82 to 1 machine-to-human ratio and the broader growth in AI-related secret leakage. The programme that survives this shift will be the one that can answer who owns each non-human identity, what it can reach, and which policy can stop it before blast radius expands.

For practitioners

• Map every non-human identity to an accountable owner Tie service accounts, API keys, tokens, certificates, and AI agents to a named business or technical owner, then remove identities that cannot be assigned to a real owner. Use relationship graphing so orphaned access is visible before it becomes residual privilege.
• Replace standing machine credentials with time-bound access Issue just-in-time access for workload tasks and revoke it automatically when the task ends. Prioritise identities that currently live inside code, CI/CD systems, and SaaS-to-SaaS integrations because those are the easiest places for exposure to persist.
• Automate decommissioning for orphaned and idle identities Connect identity discovery to offboarding so service accounts, tokens, and agents are removed when the project, pipeline, or integration ends. The control should treat inactivity, project closure, and ownership change as revocation triggers, not review cues.
• Enforce runtime policy for AI agents Define what each agent may touch at execution time, not just what it can authenticate to. Use policy boundaries that can stop or constrain mid-action if the agent attempts to move outside its approved scope.

Key takeaways

• NHI governance has moved beyond inventory, because machine identities now outnumber human logins and can persist outside human lifecycle controls.
• Leakage and revocation remain the critical gap, with valid secrets often surviving long after discovery and giving attackers a durable foothold.
• AI agents force a runtime policy model, where ownership, containment, and mid-action control matter more than static entitlement review alone.

Key terms

• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Standing Credential: A standing credential is any secret that remains usable until it is manually rotated or revoked. In NHI governance, it creates durable access that can be stolen, replayed, or propagated from trusted tooling unless runtime boundaries and expiry are built in.
• Runtime Policy Enforcement: Runtime policy enforcement evaluates a request at the moment it is executed instead of relying only on preconfigured permissions. For AI agents, this allows decisions to reflect current context, target sensitivity, and behavioural signals rather than static assumptions.
• Ephemeral Access: Ephemeral access is permission that exists only for the duration of a specific task or session. For agents, it reduces the lifetime of credentials and limits blast radius if a workflow is abused or misrouted. The control is only effective when issuance, expiry, and revocation are enforced automatically.

What's in the full article

Securden's full article covers the operational detail this post intentionally leaves for the source:

• Ownership mapping and relationship graphing for tracking service accounts, keys, and AI agents across environments
• Just-in-time access design for replacing standing credentials in workloads and integrations
• Automated lifecycle cleanup for orphaned identities and idle machine access
• Runtime policy enforcement concepts for AI agents that need mid-action scoping

👉 Securden's full article covers the ownership model, runtime policy approach, and lifecycle controls in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.