TL;DR: C1.ai says per-seat identity pricing breaks down as bots, service accounts, and AI agents do more of the work, because non-human identities already outnumber humans by 25x to 50x in the average enterprise. Seat-based licensing now misprices identity as a headcount proxy instead of machine-speed infrastructure, and that assumption is becoming untenable.
At a glance
What this is: This is a pricing and operating-model argument that identity commercial models built around human seats no longer match the reality of agentic enterprises.
Why it matters: IAM, IGA, PAM, and NHI teams need pricing and governance models that reflect machine-speed access, consumption, and lifecycle control across human and non-human identities.
👉 Read C1.ai's analysis of usage-based pricing and the agentic identity workload
Context
The core issue is not pricing mechanics alone. It is the mismatch between a commercial model built for human logins and an identity estate increasingly driven by bots, service accounts, and AI agents.
In an agentic enterprise, identity is infrastructure that mediates actions, enforces policy, and consumes resources continuously. When the workload shifts from seats to actions, governance and budgeting both need to be based on usage rather than headcount.
Key questions
Q: How should teams price identity platforms when bots and agents drive most of the workload?
A: Teams should separate human licensing from machine consumption and price around measurable identity actions such as access requests, entitlement changes, tool calls, and provisioning events. That approach aligns commercial usage with real operational load, avoids shelfware, and gives security and finance the same picture of what the identity programme actually does.
Q: Why do per-seat models misrepresent non-human identity governance?
A: Per-seat models assume value is created by named users logging in, but non-human identities create load through repeated execution, policy checks, and delegated access. When bots, service accounts, and AI agents dominate activity, seat counts stop reflecting the control plane, so governance and budgeting both lose accuracy.
Q: What breaks when identity programmes are measured only by headcount?
A: Headcount-only measurement hides the identities that actually consume entitlements, trigger policy checks, and create operational risk. It also encourages organisations to undercount agents and service accounts, which makes inventory, cost allocation, and access governance appear healthier than they are.
Q: Should organisations treat AI agents like human users in IAM?
A: No. Human IAM assumes a person logs in, works within a session, and can be reviewed later as a stable identity holder. Agents can act at machine speed, across multiple systems, and with changing runtime context, so they need identity governance built around execution and delegation rather than human authentication patterns.
Technical breakdown
Why per-seat pricing fails for non-human identities
Per-seat pricing assumes a stable one-to-one relationship between a named user and platform value. That breaks when bots, service accounts, and AI agents generate most of the activity, because their identity usage is event-driven, policy-driven, and often continuous. The commercial metric no longer tracks the operational unit that creates load. In identity terms, the estate is consumed by actions, not by users, so any model anchored to human seats will distort both cost allocation and governance visibility.
Practical implication: align licensing and reporting to identity actions and lifecycle events, not named-user counts.
Machine-speed identity changes the governance problem
The article frames identity as always-on infrastructure that mediates access requests, entitlements, policy evaluation, and tool calls in real time. That means the governance surface is no longer a static population of people to count, but a dynamic stream of machine and human identity events to control. For NHI programmes, this shifts the emphasis from who holds a seat to what identity is executing, what it can access, and how quickly its access changes over time.
Practical implication: instrument identity governance around request volume, entitlement churn, and policy enforcement events.
Usage-based pricing mirrors how identity platforms actually operate
C1.ai describes usage-based pricing as tied to access requests, entitlement changes, MCP tool calls, account provisioning, AI client connections, and policy enforcement. Those are operational identity events, not vanity metrics. The technical point is that a platform enforcing identity in an agentic environment behaves more like infrastructure than a user application. When pricing follows that flow, it can better reflect the real control plane the organisation is running.
Practical implication: treat identity platform consumption as an infrastructure metric and map it to the actions the platform governs.
NHI Mgmt Group analysis
Per-seat identity pricing is now a governance mismatch, not just a billing issue. The article describes a market where non-human identities outnumber humans by 25x to 50x, and that ratio changes the meaning of identity consumption. When bots and agents do the work, the commercial unit and the governance unit diverge. Practitioners should read this as a signal that identity programmes must measure actual execution demand, not employee headcount.
Agentic enterprises collapse the old assumption that identity value can be priced at provisioning time. That assumption worked when humans were the primary actors because usage was relatively predictable. In agentic environments, access is invoked continuously and often by non-human actors whose workload is not knowable from a seat count. The implication is that identity governance increasingly depends on runtime consumption signals, not static population forecasts.
Identity is becoming infrastructure in the same way cloud compute did. The article is right to compare this shift with earlier infrastructure pricing transitions because throughput matters more than ownership. For identity teams, that means commercial models, control models, and lifecycle models all need to converge on the same reality: actions, not users, define the load. Programme leaders should test every seat-based assumption against the actual identity workload mix.
Usage-based models expose the true shape of the identity estate. When consumption is tied to access requests, entitlements changed, and tool calls, the organisation sees where identity work is actually happening. That visibility matters because it forces alignment between budgeting, governance, and architecture. Practitioners should use the pricing debate as a prompt to re-baseline NHI inventory, agent access, and entitlement churn.
Identity workload visibility: the real issue is not whether a platform charges per seat or per action, but whether the organisation can see which identities are generating operational demand. In agentic enterprises, that visibility becomes the foundation for both fair cost allocation and defensible governance. Teams should expect commercial pressure to surface hidden machine identity sprawl.
What this signals
Commercial models are becoming a governance signal. When licensing is tied to actions rather than seats, the organisation gets a clearer view of how much of its identity workload is machine-driven. That matters because the same dataset that supports pricing also exposes where NHI inventory and agent access are no longer aligned with the actual operating model.
Seat-based assumptions will age out before many identity programmes do. The practical test is whether your reporting can distinguish human use from identity infrastructure load. If it cannot, then pricing, capacity planning, and entitlement governance are all being built on the wrong denominator.
For practitioners
- Separate human seats from machine workload Track bots, service accounts, and AI agents as a distinct consumption class so identity budgets do not hide real platform demand.
- Map identity controls to billable actions Tie internal reporting to access requests, entitlement changes, tool calls, account provisioning, and policy enforcement rather than named-user counts.
- Rebaseline NHI inventory against runtime usage Compare assigned identities with actual execution volume to find dormant seats, overused automations, and governance blind spots.
- Review agent access economics separately Evaluate AI client connections and MCP tool usage as their own governance stream because agent activity does not map cleanly to human licensing.
Key takeaways
- The post argues that identity commercial models built around seats no longer match how bots, service accounts, and AI agents actually consume access and policy.
- The central governance issue is not cost alone. It is the mismatch between a human-user pricing model and a machine-speed identity estate.
- Practitioners should separate human licensing from machine workload, because usage data now reveals both operational load and governance blind spots.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centres on AI agents and their identity consumption in production systems. |
| Recommendation — Map agent access, privilege, and usage controls to ASI03 so agent activity is governed as a distinct identity class. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Bots, service accounts, and AI agents consume identity resources without seat-based accounting. |
| Recommendation — Review machine identities for overprivilege and align billing, access scope, and lifecycle controls to actual usage. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about governing who or what consumes entitlements and access in real time. |
| Recommendation — Use PR.AA-05 to tie entitlement governance to actual identity consumption rather than headcount. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Machine identities need managed credentials and lifecycle visibility as usage grows. |
| Recommendation — Apply IA-5 to manage credentials for service accounts and agents on the basis of real operational demand. | ||
Key terms
- Agentic enterprise: An operating model where humans and autonomous AI systems work together inside the same business workflows. The security challenge is that decisions, data movement, and access all happen at machine speed, so governance must track both the actor and the workflow context.
- Identity Workload: Identity workload is the total amount of access-related activity a platform must process, including authentication, authorisation, entitlement changes, policy checks, and audit events. It matters because machine and agent populations can create far more demand than seat counts suggest, especially in automated environments.
- Usage-based Pricing: Usage-based pricing ties commercial cost to measured activity rather than to a fixed number of named users. In identity programmes, that usually means charging by requests, policy actions, tool calls, or other runtime events. It is a better fit when machine identities generate most of the workload.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
What's in the full article
C1.ai's full blog covers the operational detail this post intentionally leaves for the source:
- C1 Tokens pricing mechanics, including prepaid annual credits and pay-as-you-go options
- Real-time usage dashboards and threshold alerts for identity consumption tracking
- The exact action types used for billing, including MCP tool calls and policy enforcement
- How the agentic-first operating model influences the company's own internal identity workflows
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 4, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org