Runtime NHI visibility is not enough for agent governance

At a glance

What this is: This is a runtime identity visibility analysis showing that inventories alone cannot govern non-human identities once agents, service accounts, and API keys are actively in use.

Why it matters: It matters because IAM, PAM, and IGA teams need current usage, ownership, and scope data to control blast radius across NHI, autonomous workflows, and human-account delegation.

By the numbers:

• NHIs outnumber human identities by 25x to 50x in modern enterprises.
• Only 5.7% of organisations have full visibility into their service accounts.
• 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.

👉 Read Island's analysis of runtime NHI visibility and agent governance

Context

NHI governance breaks when security teams can list identities but cannot prove which ones are active, who is using them, or whether current use still matches the access originally granted. In environments where service accounts, API keys, OAuth grants, and agent-driven tool calls coexist, inventory is only the first layer of control. Runtime visibility is the missing governance layer for NHI programmes and for the human teams accountable for them.

The article argues for a live identity picture rather than a static catalogue: one that ties usage back to the credential, the resource, and, where possible, the human owner. That framing is especially relevant for organisations trying to manage agentic AI alongside traditional machine identity, because the operational problem is not identity existence but identity behaviour at the moment of use.

For practitioners, this is a reminder that NHI controls must connect discovery, runtime observation, and remediation paths. The operational question is no longer whether an identity was issued, but whether it is still justified, correctly scoped, and attributable when it acts.

Key questions

Q: What breaks when NHI governance relies on inventory alone?

A: Inventory alone tells you what credentials exist, but not whether they are active, over-scoped, shared, or being used by an agent at runtime. That leaves dormant keys, stale accounts, and hidden privilege drift outside the control process. Effective NHI governance needs evidence of use, ownership, and scope, not just a list of issued identities.

Q: What problem does ownership attribution solve for service accounts and API keys?

A: It closes the gap between exposure detection and accountable remediation. Many organisations can find the secret, but not the human who introduced it, maintains it, or can safely replace it. Ownership attribution gives security teams a practical way to assign action without relying on informal knowledge that disappears during staff changes.

Q: How do security teams know if NHI controls are actually working?

A: Look for complete inventory coverage, clear ownership, enforced rotation, and evidence that unused credentials are removed on time. If secrets remain active after changes to applications, vendors, or pipelines, the control is not working. Monitoring should also show whether machine access stays within the expected workload scope.

Q: Who is accountable when an AI agent exposes credentials or changes identity state?

A: Accountability should sit with the business owner of the agent, the identity team that granted scope, and the control owner responsible for the affected workflow. If the agent touched privileged systems, incident handling should follow the same seriousness as any privileged access failure, because the issue is not just misuse but governance collapse across the identity layer.

Technical breakdown

Why NHI inventory stops short of runtime governance

A static inventory tells you an identity exists, but it does not prove whether the credential is active, which resource it touched, or whether the access pattern matches the approved scope. In NHI environments, those are different control questions. Discovery answers existence. Runtime telemetry answers behaviour. Correlation between the two is what turns raw identity data into governance evidence. Without that correlation, dormant credentials, shared credentials, and over-scoped service accounts remain hidden until abuse or drift becomes visible through an incident.

Practical implication: pair inventory systems with runtime telemetry so entitlement review includes observed use, not just issued access.

Gateway-mediated access changes the NHI control model

A gateway can sit between an agent and the tools it calls, issuing scoped access on demand and centralising policy enforcement. That architecture changes how credentials are handled because the raw secret no longer has to live inside the agent session. It also creates a control point for task-scoped access, command filtering, and cut-off without modifying the underlying application credential. The important distinction is that the gateway governs the path, while the identity record still governs ownership and lifecycle.

Practical implication: use gateway controls to reduce standing exposure, but keep lifecycle and ownership controls in the identity source of truth.

Why ownership tracing is becoming part of NHI governance

When non-human identities are created by developers, platform teams, SaaS administrators, or AI workflows, accountability fragments quickly. A useful governance model ties each discovered identity back to the human or team responsible for it, even if the link is inferred from system context or behaviour. That matters because remediation, offboarding, and incident response all depend on knowing who can revoke, rotate, or explain the credential. In practice, ownership is not just an audit field; it is the route to action.

Practical implication: build ownership mapping into NHI records so remediation can begin with a real accountable team, not a mystery credential.

Threat narrative

Attacker objective: The attacker wants to exploit valid non-human access to act inside trusted systems while remaining difficult to distinguish from normal automation.

1. entry via a valid but over-broad service account, API key, or OAuth grant that an agent can use without additional challenge.
2. escalation through persistent standing access, credential sharing, or scope drift between what was granted and what is actually exercised.
3. impact through unauthorised actions, data exposure, or unintended tool calls that expand blast radius before anyone notices.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• Dropbox Sign breach — compromised Dropbox Sign service account exposed API keys and OAuth tokens.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime identity visibility is now the control boundary, not a reporting feature. The problem this article surfaces is that inventory-only tooling cannot answer whether an NHI is active, over-scoped, or being used by an agent right now. That makes runtime correlation the decisive layer for NHI governance, because existence without behaviour is not enough to manage blast radius. Practitioners should treat runtime observation as the evidence layer that closes the gap between issuance and use.

Access review assumptions break down when identities are used by agents. Traditional review cycles assume a credential remains stable long enough to be observed, challenged, and recertified. That assumption weakens when agents can consume credentials through tool paths and task windows that are far shorter than human governance cycles. The implication is not just better monitoring, but a rethinking of what an access review is supposed to certify.

Identity for every agent is only useful if it preserves accountability. Tying discovered NHIs back to a human owner is the difference between observability and governability. Without an accountable owner, revocation, rotation, and incident response become forensic exercises instead of operational controls. Security teams should interpret ownership mapping as a lifecycle requirement, not a convenience feature.

Runtime governance must separate the credential, the actor, and the control plane. The article’s architecture points to a useful conceptual split: the NHI is the credential, the agent is the actor, and the gateway is the enforcement layer. Collapsing those into one object creates policy confusion, especially when the same service account may be used by multiple agents or systems. Practitioners should structure governance so each layer has a distinct control and distinct evidence trail.

From our research:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to Ultimate Guide to NHIs.
• 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
• For a deeper lifecycle view, see Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs for provisioning, rotation, and offboarding patterns.

What this signals

Runtime identity evidence will become the dividing line between mature and immature NHI programmes. With only 5.7% of organisations reporting full visibility into their service accounts, the governance gap is already structural rather than incidental. Teams that can correlate issued access with observed use will be able to prioritise revocation, scoping, and ownership work far more effectively than teams relying on inventory exports alone.

Credential sharing and hidden storage are still the operational weak points. The fact that 96% of organisations store secrets outside of secrets managers means runtime controls cannot be the only response. The practical next step is to pair observation with lifecycle cleanup, because discovery without offboarding simply documents the sprawl.

Identity blast radius is the right concept for agent-era programmes. As agents begin to reuse existing machine credentials, the main question is not just what exists but how far a credential can move across tools before containment kicks in. That makes least privilege, ownership mapping, and scoped gateway controls part of the same governance conversation.

For practitioners

• Correlate inventory with runtime telemetry Join identity records to endpoint, network, and tool-call telemetry so teams can see which service accounts, API keys, and OAuth grants are actually active. Prioritise identities with usage that exceeds their documented business purpose.
• Map every discovered NHI to an accountable owner Require a human or team owner for each service account, token, and agent-facing credential, even when the owner is inferred from system context. Use that mapping to drive rotation, revocation, and incident routing.
• Scope access by task, not by credential lifetime Where agent workflows are involved, issue access through a control point that can constrain actions to the current task and cut off the path without touching unrelated systems. This reduces standing exposure when the underlying secret cannot be eliminated immediately.
• Review for shared credentials and silent sprawl Flag cases where one credential appears across multiple agents or systems, then determine whether the sharing is intentional or just legacy sprawl. Treat unexplained sharing as a governance defect, not an inventory anomaly.
• Track scope drift as a standing governance metric Compare granted access with observed access on a recurring basis and record when the real usage footprint is narrower or broader than the approved scope. Use the drift trend to prioritise remediation work.

Key takeaways

• Inventory is no longer enough when agents use machine credentials at runtime.
• The scale problem is already large, with NHIs vastly outnumbering human identities in most enterprises.
• Teams need ownership, scope correlation, and task-level control to reduce NHI blast radius.

Key terms

• Runtime Identity Visibility: Runtime identity visibility is the ability to see which non-human identity accessed which dataset, through which tool, and at what time. It connects identity governance to privacy control by making machine behaviour auditable instead of inferred from process documentation.
• Scope drift: Scope drift is the gradual mismatch between what an integration was meant to do and what its credentials still allow it to do. It happens when permissions are not revalidated as business needs change, creating hidden over-privilege across SaaS and API-connected systems.
• Identity Mapping: Identity mapping is the process of linking a secret or credential to the exact workload, repository, service, or integration that depends on it. That mapping tells defenders who owns the credential, what it unlocks, and what will break if it is rotated, which makes safe remediation possible.
• Gateway-mediated access: A privileged access model where a relay or gateway brokers the connection between a user and an internal resource. It reduces broad network exposure by constraining access to specific systems, while shifting governance onto session controls, resource inventory, and authorization policy.

What's in the full article

Island's full blog covers the operational detail this post intentionally leaves for the source:

• How the Island MCP Gateway sits between agents and tools to control authentication flow.
• How Island correlates endpoint, network, and API telemetry back to specific non-human identities.
• How the product identifies local credentials embedded in files and configs on developer machines.
• How access can be cut off at the gateway without rotating the underlying application credential.

👉 The full Island post covers the gateway architecture, runtime correlation model, and ownership tracing detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.