Why human and agent identities need unified governance

At a glance

What this is: This is an identity governance argument that says human and non-human identities must be governed together because credentials, ownership, intent, and revocation now span both populations.

Why it matters: It matters because IAM teams can no longer treat human access reviews, NHI lifecycle controls, and agent governance as separate programmes when the same authorisation chain ties them together.

By the numbers:

• AI agents are accumulating credentials faster than security teams can track them, with some organisations reporting as many as 20:1 NHIs to humans.
• Beyond having no central registry, in every enterprise we've analyzed, 95% or more of non-human identities have no assigned owner.

👉 Read Lumos's blog on governing human and agent identities together

Context

The spare key problem is an identity governance failure, not a lock failure. In practice, enterprises now have humans, service accounts, OAuth grants, API credentials, and AI agents all holding access that was once easy to assign but is now difficult to trace, review, and revoke.

The governance gap is that access outlives intent. A person authorises an agent, the agent gains credentials, and the organisation later loses sight of who owns the access, why it exists, and whether it still matches the work being done. That is why human and non-human identities have to be managed as one control surface rather than separate queues.

Key questions

Q: How should security teams govern human and NHI identities together?

A: They should use one lifecycle model for both, because the same people often authorise the access that NHIs and agents consume. That means one ownership record, one review workflow, and one revocation path. Separate queues hide the delegation chain and make orphaned access more likely.

Q: Why do unowned service accounts and agent credentials create so much risk?

A: Because no one is accountable for review or removal when circumstances change. An unowned identity may still authenticate successfully while the person who created it has changed roles, left the company, or forgotten the use case. That is how dormant access becomes persistent exposure.

Q: What do security teams get wrong about access reviews for NHIs?

A: They often review the credential instead of the lifecycle relationship behind it. A credential can be valid while the purpose, owner, or downstream delegation is no longer valid. Reviews must test ownership, intent, and activity together, or they will approve access that has already outlived its reason.

Q: Who should be accountable when an AI agent or service account causes access drift?

A: The accountable party should be the human or team that authorised the identity and owns the business process behind it. The agent cannot own its own lifecycle in a governance sense. Accountability must stay with a human owner who can approve, revoke, or re-scope access when usage changes.

Technical breakdown

Why intent must travel with every credential

A credential proves that access is valid, but it does not prove that the use is still appropriate. Intent is the missing context that links a token, key, or service account to the business purpose it was granted for. Without that context, governance becomes a binary check for validity rather than a control on purpose, scope, and continued necessity. This matters for both humans and NHIs, but it becomes urgent when AI agents can call tools, chain actions, and reuse credentials in ways the original approver did not anticipate.

Practical implication: record purpose at the point of approval and compare later activity against that stated intent.

Why ownership is a workflow, not a field

Ownership only works when it creates accountability across the lifecycle. A named owner must receive review tasks, be notified when access changes, and remain responsible when an identity becomes risky or orphaned. A spreadsheet entry does not do that. For NHIs and agent-created access, the owner is often the person or team that authorized the credential, which means governance must preserve that link even when roles change or employees leave.

Practical implication: tie every NHI and agent grant to a human accountable for reviews, changes, and revocation.

Why one identity plane beats separate human and NHI silos

Separated governance breaks down because the most important risk often sits in the handoff between actor types. A human creates the access, a service account uses it, and an agent may then extend its reach through delegated tools or downstream systems. If those relationships live in different consoles, no one sees the full chain. Unified identity governance is therefore a correlation problem as much as a control problem: the programme must connect authorisation, ownership, and lifecycle events across every identity form.

Practical implication: build one control view for humans, NHIs, and agents so ownership and delegation are visible together.

NHI Mgmt Group analysis

The spare key problem is the right metaphor for modern identity sprawl. The article is correct that the issue is not simply whether a credential works, but whether anyone still owns it, understands its purpose, and can revoke it when circumstances change. That is the structural failure behind NHI sprawl: too many valid keys, too few governance signals. Practitioners should treat this as a governance design flaw, not a tooling annoyance.

Ownership collapse is now the dominant control gap in NHI programmes. The most dangerous condition is not just over-provisioning, but access that outlives the person or team that authorised it. When 95% or more of NHIs have no assigned owner, lifecycle processes cannot function because no one is accountable for review, renewal, or removal. The practitioner conclusion is simple: an unowned credential is an ungoverned credential.

Human and non-human identities are already part of the same delegation chain. The article shows how a person authorises a workload, agent, or service account, and that access then persists beyond the original context. That means access reviews designed only for humans will miss the upstream and downstream relationships that make NHI risk visible. Security teams should manage the chain as a single governance object, not as disconnected identity categories.

Intent-based governance is the named control concept this problem needs. Intent-based governance means access is judged against why it was granted, not just whether it can authenticate or authorise successfully. That concept matters because agents and other NHIs can execute valid actions in invalid ways, which leaves static permission checks blind. The implication is that practitioners must move from key validation to purpose validation if they want governance that actually scales.

Identity governance will increasingly determine whether agentic access is manageable at all. As AI agents inherit more credentials, the old assumption that access can be reviewed later becomes weaker. The discipline now has to connect identity, ownership, and lifecycle in one operating model across humans and NHIs. Practitioners should expect the boundary between IAM and NHI governance to disappear operationally even if the organisational chart has not caught up.

From our research:

• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, with 38% having no or low visibility and a further 47% having only partial visibility, according to The State of Non-Human Identity Security.
• That same research shows only 1.5 out of 10 organisations are highly confident in securing NHIs, which helps explain why ownership and lifecycle gaps persist.
• For a broader lifecycle view, see Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs for the governance mechanics that should sit behind credential issuance and review.

What this signals

Intent-based governance: the next control layer for identity programmes is not another authentication gate but a way to compare access use against the reason it was granted. Teams that do not preserve purpose, owner, and lifecycle context will keep approving credentials they cannot meaningfully govern.

The practical signal for IAM and NHI leaders is that identity inventory is becoming less useful than identity relationship mapping. If you cannot connect a human approver to the NHI or agent they authorised, you do not have a governance model, only a list of active secrets.

As AI agents and other NHIs continue to multiply, the governance boundary moves toward lifecycle discipline and delegated accountability. The programmes that win will be the ones that can treat humans, workloads, and agents as one access graph rather than three separate queues.

For practitioners

• Map every credential to a human owner Inventory OAuth grants, API keys, service accounts, and agent-issued access together, then assign a named accountable owner for each one. Make that owner responsible for review, renewal, and revocation decisions.
• Capture intent at approval time Record the business purpose for each grant, such as the system, scope, and expected use pattern, so later reviews can compare actual activity against the original reason for access.
• Consolidate human and NHI lifecycle events Bring joiner, mover, leaver, recertification, and offboarding events into one workflow so changes in employment, team structure, or agent ownership trigger access reassessment automatically.
• Flag orphaned and dormant access for removal Prioritise credentials with no clear owner, no recent activity, or scopes that have never been exercised, then route them for revocation or re-approval before the next review cycle.

Key takeaways

• The spare key problem is an identity governance problem: valid credentials are multiplying faster than organisations can track ownership, intent, and removal.
• The evidence points to a structural gap, not a narrow tooling issue, with most organisations lacking full visibility into third-party OAuth-linked access and many NHIs still unowned.
• The practical response is unified lifecycle governance across humans, NHIs, and agents so every credential is tied to a human accountable for its purpose and revocation.

Key terms

• Intent-based governance: An identity governance approach that evaluates access against the purpose for which it was granted. Instead of asking only whether a credential is valid, it asks whether the current use matches the approved business intent, owner, and lifecycle context.
• Orphaned identity: A non-human or human identity that still exists and may still authenticate, but no longer has a clear accountable owner. Orphaned identities are dangerous because reviews, renewals, and revocations fail when no one is responsible for them.
• Delegation chain: The full sequence of identities and approvals through which access is passed, such as human to service account to API to agent. Security teams need to understand the chain because risk often appears where one actor’s authority is extended by another.
• Lifecycle governance: The set of controls that manage identities from creation through review, change, and removal. In practice, it means access is not treated as permanent once issued, and ownership remains visible enough for renewal, recertification, and revocation decisions.

What's in the full article

Lumos's full blog covers the operational detail this post intentionally leaves for the source:

• How Lumos maps human owners to AI agents, service accounts, and OAuth grants across SaaS environments
• The product workflow for linking intent, approval, and lifecycle review into a single governance record
• Examples of how its access model handles delegation chains and dormant credentials in practice
• The specific visibility and ownership workflows the vendor says reduce orphaned access across teams

👉 The full Lumos post covers the spare key analogy, ownership workflow, and access governance model in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.