Thanksgiving shows why NHI governance starts with identity inventory

At a glance

What this is: A Thanksgiving-themed blog post argues that non-human identity security starts with inventory, role definition and cleanup of stale access.

Why it matters: IAM, PAM and NHI teams need identity inventory because you cannot govern access, lifecycle or privilege for assets you have not discovered.

Context

Non-human identity governance fails first when organisations do not know what identities exist. In plain terms, applications, APIs and workloads can accumulate access outside of any clear ownership or policy boundary, which makes later control decisions fragile from the start.

This article uses a holiday analogy to make a governance point: discovery, role assignment and cleanup are not separate phases, they are the operating model for NHI control. The inventory problem is central for teams trying to move from ad hoc credential management to lifecycle governance.

The article is a light editorial piece, but the underlying issue is serious. When stale permissions, unrotated secrets and unused credentials are treated as leftovers instead of governance failures, attack surface persists long after the original business need has passed.

Key questions

Q: What breaks when organisations cannot see all of their non-human identities?

A: What breaks is governance itself. Without a complete inventory, teams cannot confirm who owns a credential, whether it still has a valid purpose, or whether it should be rotated or removed. Discovery gaps also hide over-privilege and stale secrets, which means incident response and access review both start from incomplete data.

Q: Why do stale credentials create such persistent NHI risk?

A: Because credentials often remain valid after the business need has ended, which means access continues even when accountability has already drifted. That persistence creates an exposure window for misuse, lateral movement, and accidental overreach. The longer the credential survives, the more governance has already failed.

Q: How should teams prevent permission drift in NHI environments?

A: By defining roles tightly, assigning each identity to a known function and enforcing those rules automatically. When permissions are granted informally, access tends to expand over time as new uses are added. Governance works best when role boundaries are explicit, reviewable and tied to the service’s real purpose.

Q: Should identity teams treat credential cleanup as part of lifecycle management?

A: Yes. Cleanup is not a separate housekeeping task, it is the final stage of lifecycle control. When a workload is retired or an integration changes, permissions, secrets and unused accounts should be removed together so residual access does not outlive the service it supported.

Technical breakdown

Why identity inventory is the first control

Identity inventory is the process of discovering every non-human identity in scope, including applications, APIs and workloads, then tying each one to an owner and purpose. Without that baseline, teams cannot tell whether a credential is legitimate, whether access is still needed, or whether a service account belongs to an active business process. In NHI governance, inventory is not bookkeeping. It is the prerequisite for lifecycle control, policy assignment and eventual offboarding. Practical implication: build a complete, continuously refreshed inventory before expecting role or secret controls to work.

Practical implication: establish discovery as the first governance control, not a downstream reporting exercise.

How role definition prevents permission drift

Role definition gives each NHI a clear permission envelope so access aligns with function rather than convenience. When roles are vague, teams tend to overgrant access to keep systems moving, and those exceptions become the new normal. Policy-driven automation matters because manual enforcement cannot keep up with the pace of service creation, change and retirement. In practice, role design is what separates governed machine access from inherited sprawl. Practical implication: map every NHI to a specific role pattern and remove broad, informal permission bundles.

Practical implication: align each NHI to a narrowly defined role and remove standing permission drift.

Why stale secrets and unused credentials become residual risk

Stale permissions, unrotated secrets and unused credentials are the residue of poor lifecycle hygiene. They persist after a service changes, a workload is retired, or an integration is no longer needed, yet they often remain valid enough to be exploited. That is why cleanup is a governance activity, not a housekeeping task. If the credential still authenticates, the risk still exists, regardless of whether anyone remembers its purpose. Practical implication: treat credential cleanup as part of offboarding and access review, not as an occasional audit task.

Practical implication: fold secret and credential cleanup into offboarding and recertification workflows.

Breaches seen in the wild

• Cloudflare Thanksgiving breach 2023: One service token and three service accounts left unrotated after the Okta breach gave a nation-state attacker access to Cloudflare's Atlassian systems.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity inventory is the control plane for NHI governance. If an organisation cannot enumerate its applications, APIs and workloads, it cannot govern them. Discovery establishes the boundary for ownership, policy and lifecycle decisions, which means every later control depends on this first step being accurate. The practitioner lesson is simple: inventory quality determines whether NHI governance is real or performative.

Role clarity matters because machine access drifts faster than human process can track. The article’s Thanksgiving analogy reflects a broader truth that access granted for convenience tends to outlive its original purpose. NHIs do not self-correct when permissions become excessive, so unclear roles become long-term control debt. Teams should treat permission design as a lifecycle discipline, not a one-time setup task.

Leftover credentials are the governance equivalent of unattended leftovers. Stale permissions, unrotated secrets and unused credentials represent residual privilege that persists after the business reason has passed. That is a lifecycle failure, not just a hygiene issue. Practitioners should see every unreclaimed credential as evidence that offboarding and review processes are incomplete.

NHI governance breaks when inventory, role assignment and cleanup are managed as separate activities. The article’s strongest point is that these controls are interdependent: discovery informs roles, roles inform permissions, and cleanup closes the loop. A fragmented programme will always lag reality. The implication is that identity governance must be built as a connected operating model across the full NHI lifecycle.

From our research library:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs

What this signals

NHI identity inventory debt: Many programmes still focus on secret rotation before they can answer a more basic question: what identities exist, who owns them and what business service they support. That sequencing mistake leaves governance reactive, because cleanup and policy enforcement only work after discovery has established the full estate.

Teams should expect NHI governance to converge with lifecycle management rather than remain a standalone security checklist. Once applications, APIs and workloads are treated as governed identities, offboarding, recertification and role design become one connected process instead of separate operational chores.

For practitioners

• Build a complete NHI inventory Discover applications, APIs and workloads, then assign each identity an owner, purpose and business service so nothing sits outside governance.
• Define explicit role boundaries Map each NHI to a narrow role and remove broad permission bundles that were created for convenience rather than function.
• Eliminate stale access residue Review stale permissions, unrotated secrets and unused credentials together so cleanup closes the lifecycle loop instead of becoming a one-off audit exercise.
• Tie cleanup to offboarding Require credential revocation and access removal whenever an application, integration or workload is retired or repurposed.

Key takeaways

• NHI governance fails early when organisations cannot inventory the applications, APIs and workloads already in use.
• Stale permissions, unrotated secrets and unused credentials are not leftovers in a benign sense, they are residual access risk.
• The practical fix is to connect discovery, role definition and cleanup into one lifecycle-driven control model.

Key terms

• Non-Human Identity inventory: A non-human identity inventory is the authoritative record of machine identities in an environment, including service accounts, tokens, API keys, certificates, and workload identities. It links each identity to ownership, environment, usage, and lifecycle state so security teams can review and govern access consistently.
• Role Drift: Role drift is the gradual mismatch between a defined role and the access it actually carries. It appears when exceptions, temporary grants, or outdated job mappings accumulate, causing automated provisioning to assign permissions that no longer reflect current business need.
• Residual Access: Residual access is any permission, token, account, or data path that continues to work after a user should no longer have access. It is a common failure mode in SaaS-heavy environments because deprovisioning one system does not automatically shut down all downstream connections.
• Lifecycle Hygiene: The discipline of keeping non-human identities current from creation through offboarding. It covers discovery, role assignment, secret rotation, review and revocation, with the goal of ensuring machine access does not outlive the service it supports.

Deepen your knowledge

NHI governance, identity lifecycle management and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.