TL;DR: Unosecur argues that AI agents and other non-human identities cannot be secured with human MFA alone because they authenticate through policy, attestation, and short-lived credentials instead. The practical shift is to govern machine-native access, lifecycle, and runtime evidence as Zero Trust requirements, not extensions of human login controls.
At a glance
What this is: This article explains why AI agents and other non-human identities need machine-native authentication, short-lived credentials, and lifecycle governance instead of human MFA patterns.
Why it matters: It matters because IAM, IGA, PAM, and NHI programmes now have to govern non-interactive access, runtime evidence, and de-provisioning for machine actors as core Zero Trust controls.
By the numbers:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
👉 Read Unosecur's analysis of AI agent identity and NHI governance in zero trust
Context
AI agent identity and NHI governance are moving from edge cases to core identity architecture. When a non-human identity calls systems directly, the control model changes from human prompts and interactive login to policy-driven, machine-centric verification.
The article’s central point is that Zero Trust for NHIs depends on short-lived credentials, attestation, ownership, and continuous authorization evidence. Human MFA is not the right control for software that acts without a person in the loop, and lifecycle governance becomes part of the authentication model rather than a separate administrative step.
Key questions
Q: Why do human MFA controls fail for AI agents and service accounts?
A: Human MFA depends on an interactive person who can receive and approve a challenge, but AI agents and service accounts authenticate non-interactively. Their trust model is policy, scopes, attestation, and runtime evidence, so adding OTP or push approval does not prove the software identity is trustworthy. The control has to change with the actor type.
Q: When should organisations replace static secrets with ephemeral credentials?
A: Use ephemeral credentials whenever a workload can tolerate short-lived access and the secret would otherwise persist across deploys, environments, or teams. That is especially important for CI/CD pipelines, privileged APIs, and automation that touches sensitive data. Ephemeral access reduces exposure, but only if the organisation also enforces revocation and monitoring.
Q: What are the signs that NHI governance is failing in agentic AI environments?
A: NHI governance is failing when security teams cannot answer basic questions about ownership, approval, and shutdown. Common warning signs include unclear tool-call sign-off, limited visibility into automated workflows, and access paths that persist after they are no longer needed. If leaders rely on tribal knowledge instead of recorded controls, the environment is already operating outside safe boundaries.
A: Security teams should pair continuous machine identity with threat detection so every machine connection is verified before it is trusted. In OT, that means authenticating devices, limiting which systems can initiate or maintain sessions, and enriching detections with identity context. This reduces blind trust in east-west traffic and gives responders clearer evidence for containment and recovery.
Technical breakdown
Why human MFA breaks for non-human identities
Human MFA assumes an interactive user who can receive and approve a challenge. NHIs such as service accounts, workloads, bots, and AI agents authenticate non-interactively, often through OAuth 2.0 client credentials, workload identities, or delegated tokens. That means the security question is not whether a person can confirm a prompt, but whether the software identity is scoped, attested, and authorized for the specific action. Policy, environment, and runtime evidence become the trust inputs. Practical implication: replace human-centric login assumptions with machine-native authentication and authorization paths.
Practical implication: govern non-interactive authentication as a separate control plane from human access.
Short-lived credentials and federation reduce NHI blast radius
Static secrets create persistence, rotation toil, and excessive blast radius when they are copied into code, pipelines, or infrastructure. The article points to federation, managed identities, STS-style temporary credentials, and workload identity federation as better primitives because they issue access at runtime and limit what remains valid after a task ends. The governance benefit is not just convenience. It is that the credential’s lifetime aligns with the actual work being done, which narrows exposure when an identity is misused or compromised. Practical implication: prefer ephemeral issuance over stored secrets wherever workloads can support it.
Practical implication: align credential lifetime with task lifetime, not system lifetime.
Attestation and mTLS prove what the workload is
Possession of a token does not prove the workload behind it is trustworthy. Attestation and mTLS add machine identity evidence by binding access to where the workload runs, what image it uses, and what runtime properties it presents. In SPIFFE and SPIRE-style patterns, the identity is cryptographically tied to the workload and rotated automatically, which gives policy engines something stronger than bearer-token possession. This matters because machine identity governance is really about proving the software actor, not just authenticating a credential holder. Practical implication: bind authorization decisions to attested workload identity and request context.
Practical implication: require attested workload identity before authorizing sensitive machine-to-machine access.
Threat narrative
Attacker objective: The attacker wants durable machine-to-machine access that bypasses human interaction, widens blast radius, and enables unauthorised system actions at scale.
- Entry occurs when a static secret, app credential, or delegated token is reused by a machine identity outside the narrow task it was intended for.
- Escalation follows when the compromised non-human identity has broader scopes, standing permissions, or access paths to API and infrastructure resources.
- Impact lands in lateral movement, data access, or unauthorized automation because the machine identity can act without a human approval gate.
Breaches seen in the wild
- Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
- Cisco Active Directory credentials leak 2025: Kraken leaked Cisco Active Directory hashes, including service and krbtgt accounts; Cisco says they came from its 2022 breach, not a new one.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Machine identity has become a first-class governance domain, not a subtopic of human IAM. AI agents, workloads, and service accounts now initiate access directly, which means the identity programme must govern software actors on their own terms. Human login design cannot carry the full burden because the subject is not a person, the control loop is not interactive, and the evidence is not a password or prompt. The practitioner implication is that NHI governance must stand beside human IAM, not underneath it.
Standing privilege is the wrong default for agentic and workload access. The article shows that machine-native access should be short-lived, scoped, and issued at runtime, because persistent credentials turn every software actor into a reusable attack path. This is where NHI governance, Zero Trust, and lifecycle controls converge: ownership, expiry, and de-provisioning are no longer administrative tasks after the fact. The implication is that privilege should exist only for the duration of the task that justifies it.
Identity blast radius is the right named concept for this shift. The article’s practical message is that the real control objective is not simply authentication strength, but how far a credential can reach when a machine actor is abused. Short-lived tokens, federation, and attestation all reduce blast radius by limiting persistence, scope, and portability. Practitioners should measure identity risk by reachable privilege, not by how many controls sit in front of login.
Zero Trust for NHIs requires evidence at runtime, not policy at provisioning time. Traditional governance assumes access can be reviewed after it exists, but machine identities often act faster than review cycles and may never present an inspectable human lifecycle event. The article reinforces that continuous authorization, logging, and provenance evidence are now core identity controls. The implication is that governance has to move from periodic certification to continuous issuance and verification.
Lifecycle governance is now part of authentication governance. The article ties ownership, purpose, expiry, rotation, and de-provisioning directly to machine identity trust, which means offboarding is not a back-office cleanup step. When an NHI is no longer needed, the security impact is immediate if access remains alive. The practitioner implication is simple: treat de-provisioning as a trust control, not an administrative courtesy.
From our research library:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- Read next: Ultimate Guide to NHIs
What this signals
Identity blast radius is now the operative control variable. When AI agents and workloads can obtain and discard access at runtime, the old assumption that access will persist long enough to be reviewed stops holding. Security teams should measure how far a non-human identity can reach, not just whether it can authenticate.
Lifecycle events have to be enforced at issuance time. Ownership, expiry, and de-provisioning matter because machine actors do not leave predictable human offboarding signals behind. When the actor is an agent or workload, access review alone is too late to contain the risk window.
For practitioners
- Define machine-native authentication paths Use app-only flows, workload identities, or delegated tokens for non-human actors instead of human MFA prompts. Require each path to be explicitly tied to the identity type that is actually acting.
- Replace static secrets with ephemeral credentials Move workloads toward federation, temporary credentials, and managed identities so access expires with the task. Remove stored keys from code, pipelines, and long-lived configuration wherever possible.
- Attach ownership and expiry metadata Record owner, purpose, environment, and expiry on every service account, bot, and agent identity. Use that metadata to drive review, revocation, and de-provisioning decisions.
- Bind authorization to attested runtime identity Require workload attestation and mTLS-backed identity before allowing sensitive service-to-service actions. Do not treat token possession alone as proof of trustworthy execution.
- Log policy decisions and API actions together Correlate token issuance, policy decisions, and API calls so each non-human action can be traced back to a specific identity and scope. This is the audit trail Zero Trust needs for machines.
Key takeaways
- AI agents and other non-human identities need machine-native authentication, not human MFA repackaged for software.
- Short-lived credentials, attestation, and explicit ownership reduce the blast radius of machine identity misuse.
- Zero Trust for NHIs succeeds when issuance, runtime verification, logging, and de-provisioning are treated as one lifecycle.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST Zero Trust (SP 800-207) sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article centres on non-interactive authentication for NHIs and AI agents. |
| NHI-07 — Long-Lived Secrets | It explicitly recommends short-lived credentials over static secrets for NHIs. | |
| NHI-05 — Overprivileged NHI | Least privilege and scoped access are central to the article's Zero Trust model. | |
| Recommendation — Replace human MFA assumptions with machine-native authentication paths and policy-driven verification. Eliminate long-lived secrets and issue ephemeral credentials for task-scoped access. Scope every NHI to the minimum permissions needed for the task and revoke excess access. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The article's threat model is about compromised machine credentials enabling spread. |
| Recommendation — Map NHI compromise paths to credential access and lateral movement, then hunt for broad token reuse. | ||
| NIST Zero Trust (SP 800-207) | Policy Decision Point — Policy Decision Point | The piece repeatedly frames identity as continuous policy enforcement under Zero Trust. |
| Recommendation — Bind machine access to continuous policy decisions instead of one-time authentication events. | ||
Key terms
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Machine-Native Authentication: Authentication designed for non-human identities rather than people. It uses credentials and trust mechanisms that do not depend on MFA prompts, browser sessions or human presence, and it becomes critical when AI agents need direct access to cloud and SaaS systems.
- Workload Attestation: Workload attestation is the process of proving that a workload is running in an expected, trusted environment before granting access. It helps stop copied credentials from being treated as universally valid and is a core control for reducing impersonation risk.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
What's in the full article
Unosecur's full blog covers the operational detail this post intentionally leaves for the source:
- Concrete examples of non-interactive authentication flows for service accounts, workloads, and AI agents
- Implementation guidance for federation, managed identities, and short-lived credential patterns
- Attestation and mTLS design choices for proving workload identity at runtime
- Operational steps for ownership, logging, rotation, and de-provisioning of NHIs
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org