TL;DR: Unosecur argues that identity sprawl across humans, service accounts, tokens and AI agents leaves IAM teams unable to see toxic combinations, so the real control gap is fragmented visibility rather than missing reporting. The governance shift is from isolated inventories to a continuously correlated identity graph that can surface risk before attackers move through it.
At a glance
What this is: This is an analysis of Unosecur's Unified Identity Fabric, which says IAM teams miss critical risk because identity data remains fragmented across humans, non-human identities and AI agents.
Why it matters: It matters because identity governance now has to cover machine and autonomous actors as well as people, and fragmented inventories make least privilege, detection and remediation unreliable.
👉 Read Unosecur's analysis of unified identity fabric for IAM teams
Context
Identity sprawl is now a governance problem, not just an inventory problem. When service accounts, API keys, OAuth tokens, contractors and AI agents all exist across separate systems, no single IAM team can establish a complete control picture from point-in-time reports.
Unosecur's article frames unified identity fabric as a way to correlate those identities into one graph so security teams can see relationships, privilege overlap and toxic combinations in context. The central failure is not lack of data, but the inability to connect identities, permissions and source systems before risk turns into exposure.
Key questions
Q: What breaks when identity data is fragmented across directories and cloud providers?
A: Governance breaks first. Access reviews become incomplete, lifecycle actions miss orphaned accounts, and privileged access decisions are made from partial data. In practice, that means the organisation cannot reliably answer who has access, why they have it, or whether it should still exist.
A: Because the danger comes from scope, duration and monitoring gaps, not from the object count alone. A single token with wide repository access and no expiry can expose more attack surface than many tightly governed identities. Teams should evaluate whether each credential can be traced, bounded and monitored in operational context.
Q: How should teams govern AI agent tool calls in real time?
A: Teams should govern AI agent tool calls with a runtime authorization layer that evaluates the principal, action, resource, and context on every request. Static roles are too coarse once agents can chain actions or carry delegated scopes across tools. The control point should be policy based, deterministic, and auditable so that each decision can be explained after the fact.
Q: What is the best way to reduce identity blast radius without slowing operations?
A: Use relationship-based prioritisation so remediation targets the combinations most likely to become an incident. That approach lets teams focus on privileged, long-lived or unmonitored access first, while leaving low-risk identities in normal workflows. The goal is faster action on the few records that materially change exposure, not blanket disruption.
Technical breakdown
Why fragmented identity sources hide toxic combinations
Identity systems fragment because each control plane sees only part of the estate. Cloud providers, SaaS apps, identity providers and on-prem directories each hold records that are individually accurate but incomplete in aggregate. That makes the real problem correlation, not collection. A stale token is not always urgent on its own, but a stale token attached to an admin identity with no MFA and production access becomes materially different. A unified graph is the technical pattern that turns separate records into context, so risk can be evaluated as a relationship instead of a single finding.
Practical implication: IAM teams need a cross-source correlation layer before they can reliably prioritise remediation.
How toxic combination engines change identity risk detection
A toxic combination engine evaluates identity conditions together rather than as isolated alerts. That matters because many identity failures only become dangerous when multiple weak signals align, such as broad scope, long-lived access, missing monitoring and privileged reach into production systems. The mechanism is essentially contextual scoring over the identity graph, with risk state attached to the identity and source relationship. This moves detection away from inventory noise and toward combinations that indicate real blast radius. In practice, it turns identity governance into a live decision layer instead of a backlog of disconnected findings.
Practical implication: teams should treat correlation-based prioritisation as a detection capability, not just a reporting feature.
Why AI agents look like service accounts until governance breaks
AI agents often inherit the same IAM representation as ordinary service accounts, but that shared appearance hides a different operating model. A service account usually acts within a known workflow, while an agent can invoke tools, call downstream services and expand its effective reach through those dependencies. The access problem is therefore not just the role assigned to the agent, but the combined permissions of every tool and service in its execution path. When governance only inventories the agent object, it misses the downstream blast radius created by chained authorisations and unmanaged tool reach.
Practical implication: teams need governance that follows the agent's execution path, not just its direct identity record.
Threat narrative
Attacker objective: The attacker aimed to harvest credentials and reach internal systems through a broadly scoped token that was treated as a configuration value rather than an identity.
- Entry occurred through a GitHub personal access token embedded in client-side JavaScript and scoped to hundreds of private repositories.
- Escalation followed when the token exposed additional credentials and access paths that let the actor move beyond the original repository scope.
- Impact expanded as the attacker moved for more than two months through systems that no one had connected to the token's identity context.
Breaches seen in the wild
- Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
- Cloudflare Thanksgiving breach 2023: One service token and three service accounts left unrotated after the Okta breach gave a nation-state attacker access to Cloudflare's Atlassian systems.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Unified identity fabric is becoming the practical response to identity sprawl across people, machines and agents. The article shows that isolated IAM tools fail when identities exist in multiple systems with no authoritative cross-source view. The discipline now has to treat correlation as a control objective, not a convenience layer, because risk often emerges only when identity records are combined into one operational picture.
Identity visibility is the first control, not a reporting afterthought. This article is correct to separate visibility from dashboarding because you cannot enforce least privilege on identities you have not correlated. The practitioner mistake is to assume more reports equal more control, when the real issue is whether the programme can connect source records, permissions and usage across the estate. That is where governance either becomes continuous or remains fragmented.
AI agents create a governance problem that ordinary service-account thinking cannot fully contain. The same inventory logic that handles service accounts misses tool-chained behaviour, downstream authorisations and execution paths that change the effective blast radius. Teams that classify agents as just another NHI will understate the control surface, because the agent's reach is defined by more than its direct IAM entry. Practitioners need to rethink how authority is represented across the agent and its tool chain.
Toxic combination detection is the right analytical model for modern identity risk. The article's core insight is that weak signals become decisive when combined with privilege, exposure and missing monitoring. That is a stronger operating model than reviewing findings one by one because it reflects how attackers actually traverse identity environments. The practitioner implication is that identity governance must score relationships, not merely count identities.
What this signals
Identity blast radius: the practical unit of risk is no longer the individual account, but the connected permissions, tools and systems it can reach. That shift means programme owners should measure whether they can explain an identity's full exposure path in one view, not whether they can enumerate more records.
Continuous identity governance becomes the deciding factor when service accounts, OAuth tokens and AI agents all coexist in the same estate. The programme that cannot correlate source, scope and downstream reach will keep finding issues after attackers have already used them.
For practitioners
- Map identities across all source systems Build a unified inventory that correlates users, service accounts, tokens and AI agents across identity providers, cloud platforms, SaaS and on-prem directories so each subject has one context-rich record.
- Prioritise toxic combinations over isolated findings Score risk when broad scope, long-lived access, missing monitoring and privileged reach appear together, then route only those combinations that materially expand blast radius into remediation.
- Follow AI agent access beyond the agent object Review the permissions of the tools, roles and downstream services an agent can invoke, not just the agent's direct IAM entry, because the effective blast radius extends through chained authorisations.
- Treat dormant service accounts as live governance objects Continuously review service accounts, API keys and OAuth tokens for scope, expiry, ownership and monitoring so credentials are governed as identities, not configuration values.
Key takeaways
- Fragmented identity inventories are now a governance failure because they hide how humans, service accounts and AI agents interact across systems.
- The article's central evidence is that low-severity identity issues become urgent when they are combined with broad scope, no monitoring and privileged reach.
- The most effective control change is to govern relationships and execution paths, not just to count identities or review isolated findings.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centres on service accounts, tokens and agents with more access than they need. |
| NHI-04 — Insecure Authentication | The article highlights broad tokens, missing monitoring and weak control over identity use. | |
| Recommendation — Inventory and reduce excess permissions on non-human identities before they expand attack paths. Harden non-human authentication paths and review where tokens or keys can be replayed or abused. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The AI agent discussion is about how delegated authority and tool reach expand effective blast radius. |
| Recommendation — Govern agent privileges by execution path and delegated tool access, not by the agent object alone. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about entitlement visibility and privilege correlation across identities. |
| Recommendation — Continuously validate entitlements across systems so identity records stay aligned with actual access. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The breach example involves credential exposure followed by movement through connected systems. |
| Recommendation — Map exposed tokens and reused credentials to credential-access and lateral-movement detection paths. | ||
Key terms
- Unified Identity Fabric: A unified identity fabric is a control model that connects identity data, policy, and response across different identity types in one operating view. It does not remove the need for separate lifecycle rules, but it can reduce blind spots if ownership, inventory, and remediation are consistent.
- Toxic Risk Combinations: Toxic risk combinations are unsafe interactions between datasets, access permissions, and AI workflows that only become problematic when combined. Individually they may appear harmless, but together they can expose sensitive information, enable re-identification, or create unintended inferences that traditional controls may miss.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
- Delegation Chain: A delegation chain is the sequence of identities, credentials, and tool calls an agent uses to complete a task across systems. It matters because each step may appear acceptable on its own while the combined path produces an outcome no reviewer would have approved directly.
What's in the full article
Unosecur's full analysis covers the operational detail this post intentionally leaves for the source:
- How the Unified Identity Fabric dashboard correlates identities across multiple systems
- The risk and insights workflow used to prioritise toxic combinations and remediation
- The AI agent view that ties permissions to tools and downstream services
- The compliance and audit functions that support continuous monitoring across frameworks
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 16, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org