NHI maturity is uneven across discovery, runtime, and delegation

At a glance

What this is: This is a maturity matrix for NHI programmes that says progress is uneven across discovery, lifecycle, authentication, authorization, runtime, and delegation.

Why it matters: It matters because IAM teams can overestimate control coverage if they treat visibility as maturity instead of proving ownership, effective reach, and runtime containment.

Context

NHI maturity is not a single score because discovery, credentialing, authorization, runtime control, and delegation often advance at different speeds. A programme can look strong on inventory and still be weak on ownership, containment, or agent governance.

The article frames that problem as a measurement discipline: assess each dimension on evidence that a skeptic cannot dismiss, then compare where identities are merely seen versus where they are actually governed. For IAM, IGA, PAM, and NHI programmes, the question is not whether controls exist, but whether they hold across the full identity lifecycle and execution path.

Key questions

Q: How should teams score NHI maturity without overstating progress?

A: Score each dimension independently and use evidence, not aspiration, as the benchmark. Discovery, lifecycle, authentication, authorization, runtime, and delegation can mature at different rates, so a single blended score hides control gaps and encourages optimistic reporting.

Q: What happens when discovery outpaces governance in an NHI programme?

A: The organisation gains visibility faster than it gains control. Known identities may still lack verified ownership, revocation paths, or containment mechanisms, which means the inventory improves while the real accountability gap continues to widen.

Q: What are the warning signs that NHI lifecycle controls are failing?

A: Warning signs include stale secrets that remain valid after a system changes, service accounts with no clear owner, interactive use of machine identities, and credentials that appear in code or pipelines outside a vault. These symptoms show that creation, rotation and offboarding are not tied to the same governance record.

Q: Why do delegated actions need separate governance from service accounts?

A: Delegated actions can preserve task, user, and purpose context while shifting execution through agents or tools. That means the control question is not only who has a credential, but who can act, under what context, and with what stop path.

Technical breakdown

Why NHI maturity needs separate scoring by dimension

A maturity model that compresses discovery, lifecycle, authentication, authorization, runtime, and delegation into one score hides the real control gaps. Each dimension measures a different security property. Discovery asks whether authoritative systems are connected and resolved to a principal. Authorization asks whether granted access matches observed reach. Runtime asks whether misuse can be detected and contained. Delegation adds a separate governance problem because an actor may act on behalf of another principal or through a tool chain.

Practical implication: Score each dimension independently so a strong inventory does not mask weak containment or delegation control.

Discovery and resolution are not the same as governance

Discovery tells you what exists. Resolution tells you whether an observed identity can be tied back to a principal with enough confidence to govern it. That still does not prove ownership, lifecycle control, or revocation authority. In NHI programmes, teams often stop at visibility because it is easier to count identities than to prove who can stop them, what they can do, and whether stale principals remain actionable.

Practical implication: Treat inventory as the start of governance work, not evidence that governance already exists.

Runtime observation and delegation expose the control frontier

Runtime maturity measures whether critical actions are attributable, detectable, and containable when an identity is active. Delegation maturity goes further by asking whether agents or on-behalf-of actions preserve task, user, and purpose context. Those two dimensions are where modern NHI programmes usually break down first, because visibility alone does not create enforceable response, and delegated execution can outgrow the controls designed for static principals.

Practical implication: Use runtime containment and delegated-action accountability as the hardest tests in the maturity model.

NHI Mgmt Group analysis

Visibility is not maturity: A programme can have broad discovery coverage and still be immature where ownership, containment, and delegated authority are concerned. The maturity matrix is valuable because it breaks the false assumption that an inventory of identities equals governance of identities. The practitioner conclusion is simple: count the gap between found identities and governable identities, not just the count of identities themselves.

Accountability is the missing control plane in many NHI programmes: The matrix correctly treats verified technical ownership, business sponsorship, and tested revocation paths as distinct from discovery. That matters because orphaned or unresolved identities remain usable even after they are known. The practitioner conclusion is that governance evidence must prove who can stop an identity, not merely who can describe it.

Delegation governance is the most fragile maturity dimension: Agents using unique principals, approved tool relationships, and destructive capabilities create a governance problem that is broader than classic service-account oversight. The article’s strongest contribution is showing that task, user, and purpose context must survive delegation if control is to survive execution. The practitioner conclusion is to measure delegated authority as a first-class identity domain, not a sub-note in operations.

Runtime control must be judged by containment, not observability: The article separates being able to see an event from being able to contain it. That distinction matters across NHI, IAM, and agentic workflows because many programmes confuse logs with control. The practitioner conclusion is to test whether critical actions can be attributed and stopped while they are still active.

The named concept here is governance gap between discovered and governed identities: The article implies a specific failure mode in which an organisation knows identities exist but cannot prove ownership, effective reach, or enforced response. That gap is what turns visibility into a comfort metric. The practitioner conclusion is to build maturity reporting around governable state, not inventory volume.

What this signals

Discovery coverage should be treated as a starting metric, not a maturity endpoint: Programmes that stop at inventory creation often miss whether each identity has a verified owner, a tested revocation path, and enforceable runtime containment. The operational question is whether governable state exists, not whether identities have been counted.

Delegation is where future NHI maturity models will separate mature from merely visible programmes: Once agents or on-behalf-of flows enter the estate, task context and purpose context become part of access governance. Programmes that do not measure those dimensions will underestimate the real attack and accountability surface.

For practitioners

• Score each maturity dimension separately Build a matrix for discovery, lifecycle, authentication, authorization, runtime, and delegation, then rate each row on its own evidence rather than averaging them into one programme score.
• Define governable evidence for each dimension Require proof of authoritative system coverage, principal resolution, ownership, and tested stop paths before marking a dimension as governed.
• Measure the discovery-to-governance gap Track how many identities are found versus how many have verified owners, revocation paths, and containment controls that actually work under pressure.
• Test runtime containment separately from logging Validate that high-risk actions can be attributed and contained in operation, not merely observed after the fact.
• Govern delegated actions as a distinct domain Treat agent-to-tool relationships, on-behalf-of actions, and task context retention as dedicated controls, not as an extension of static identity review.

Key takeaways

• NHI maturity should be assessed by dimension because discovery, lifecycle, authentication, authorization, runtime, and delegation do not advance together.
• The most important failure is the gap between identities that are visible and identities that are actually governed, owned, and containable.
• Programmes should measure governable evidence, not optimism, and treat delegation as a separate control domain rather than an extension of inventory.

Key terms

• NHI Maturity Model: A framework for assessing an organisation's capability to discover, govern, and secure non-human identities, typically measured across dimensions such as visibility, lifecycle management, least privilege, and monitoring coverage.
• Governable Identity: A governable identity is a non-human identity with a verified owner, clear authority boundaries, and a tested path for revocation or containment. Visibility alone does not make an identity governable. The term matters because programmes often discover more identities than they can actually control.
• Runtime containment: A control approach that limits harmful behaviour while an AI agent is still active rather than waiting for post-incident review. It depends on signals such as anomalous tool use, privilege expansion, or unusual data access so security teams can intervene before blast radius grows.
• Delegated Governance: A model in which access decision-making is moved closer to the business users who understand the data best, while security and identity teams retain oversight. It reduces central bottlenecks, but only works when assignment rules, evidence, and escalation paths are explicit and auditable.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.