Why non-human identities are becoming a governance problem

At a glance

What this is: This is One Identity's explanation of why non-human identities have moved from an operational detail to a governance problem, driven by scale, automation, AI, and machine-led infrastructure.

Why it matters: IAM and IGA teams need to govern far more identities than traditional human-centric processes were designed for, or they will miss ownership, oversight, and lifecycle control gaps across NHI estates.

By the numbers:

• Non-human identities are currently averaging a 50:1 ratio against their human counterparts, and that gap is projected to widen to as much as 100:1.

Context

Non-human identity governance is the discipline of controlling service accounts, machine identities, tokens, and other non-person identities across their full lifecycle. In this article, One Identity argues that NHIs have become a governance problem because their number, spread, and operational importance have outgrown the assumptions built into human-centred IAM programmes.

The article ties that shift to three forces: the sheer volume of NHIs, the growth of software defined infrastructure, and the security exposure created by AI-driven automation. The underlying issue is not simply more accounts, but more identity types operating outside the visibility and cadence of traditional access administration.

Key questions

Q: What breaks when non-human identities are governed like human users?

A: Lifecycle triggers, ownership, and review processes stop working because machine identities do not generate joiner, mover, or leaver events. Access can persist after the original purpose disappears, leaving valid credentials outside normal certification paths. That creates a blind spot where privileged access remains active even though nobody can clearly explain why it still exists.

Q: Why do software defined infrastructure and automation increase NHI risk?

A: Because each automation layer typically adds its own service identities, credentials, and trust paths. If those identities are not inventoried and owned, the infrastructure control plane grows faster than governance can track it. That creates unreviewed access, unclear accountability, and hidden privilege in systems that look automated but remain identity-dependent.

Q: What are the signs that NHI governance is failing in an enterprise?

A: Common warning signs include unclear ownership for service accounts, secrets stored in code or configuration instead of managed vaults, infrequent rotation, and weak offboarding of API keys. Other red flags are excessive permissions, third-party exposure without controls, and low visibility into where non-human identities exist or how they are used across the stack.

Q: How should IAM teams govern human, non-human, and AI identities together?

A: Start by separating the identity types in policy, ownership, and review cadence, then define where controls can be shared and where they must remain distinct. Human users, service identities, and AI systems do not fail in the same way, so the governance model has to preserve that difference while still producing one audit trail.

Technical breakdown

Why NHI scale breaks human-centred governance models

Human IAM processes assume a manageable population with clear ownership, review cycles, and predictable onboarding and offboarding. NHIs change that equation because they are created by platforms, pipelines, applications, and automation layers rather than by people. Once the ratio moves from dozens to hundreds of machine identities for every human identity, manual inventory and periodic review no longer keep pace. Governance must therefore treat NHIs as a distinct population with different discovery, classification, and lifecycle requirements, not as a side category of user accounts.

Practical implication: inventory NHIs separately from human users and govern them with machine-specific lifecycle controls.

How software defined infrastructure multiplies identity sprawl

Software defined infrastructure shifts configuration and execution into policy-driven automation. That model depends on multiple layers of non-human servers, service identities, and orchestration credentials to function. The security challenge is that each automation layer can introduce its own identities, permissions, and trust relationships, which expands the governance surface faster than teams can manually reconcile it. In practice, the infrastructure control plane and the identity control plane become tightly coupled, so unmanaged identity growth becomes an architecture issue as much as an access issue.

Practical implication: map every automation layer to the identities it creates or uses, then assign ownership for each layer.

Why AI raises the governance stakes for non-human identities

The article does not claim AI is the only cause of NHI growth, but it does show that AI amplifies both scale and risk. AI systems depend on data, tokens, and automated decision paths, and they can also become attack-enabling when their underlying inputs are poisoned. That means governance cannot stop at provisioning and entitlement review. It has to account for how machine-led systems consume identity, how their credentials are protected, and how quickly those credentials can be abused when an attacker reaches the automation layer.

Practical implication: extend governance to the identities and credentials that AI-enabled workflows depend on, not just the models themselves.

Breaches seen in the wild

• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

NHI governance has crossed from housekeeping into core identity governance: When non-human identities outnumber people by 50:1 and trend toward 100:1, the problem is no longer inventory alone. The governance model itself starts to fail because the organisation is applying human-scale review logic to machine-scale identity populations. That makes ownership, lifecycle, and entitlement visibility the decisive control layer for modern IAM programmes.

Software defined infrastructure turns identity sprawl into architecture sprawl: The article correctly connects automation to identity growth, because policy-driven infrastructure creates more service identities, orchestration accounts, and credentials than static environments ever did. That means identity governance is not a downstream administrative task, it is part of the operating model of the infrastructure itself. Practitioners should treat every automation domain as an identity domain.

AI widens the NHI trust boundary: AI does not replace the underlying NHI problem, it intensifies it by increasing dependence on machine-led decisions, tokens, and privileged automation paths. The governance question is no longer whether an identity exists, but whether the organisation can explain, own, and constrain the credentials that make autonomous processing possible. This is where NHI governance becomes a board-level control concern.

Governance without lifecycle discipline becomes blind privilege accumulation: Service accounts and machine identities often persist beyond the systems or workflows that created them. The article points to the same structural weakness that has long affected NHIs: identities are easy to create and hard to retire. Practitioners need to treat lifecycle ownership as a standing governance requirement, not a cleanup exercise.

The field needs an NHI-centric operating model, not a user-account extension: The central mistake is to stretch human IAM procedures across machine identities and assume coverage is enough. NHIs need their own discovery, classification, review, and offboarding logic because the underlying subject is different. The practical implication is to build NHI governance as a first-class discipline inside IGA and PAM programmes.

From our research library:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

NHI governance is now an operating-model issue: Once machine identities outnumber humans by this margin, the control problem moves beyond vaulting or password hygiene. Organisations need a lifecycle model that can account for who owns each identity, why it exists, and when it should disappear.

Software defined infrastructure makes identity part of the control plane: The article points to a structural shift where automation itself becomes an identity generator. That means governance teams need visibility into orchestration layers, not just the end-state accounts they create.

AI increases the cost of unmanaged machine credentials: AI-enabled workflows depend on tokens, service accounts, and other non-human credentials that can be reused, overprivileged, or forgotten. The practical implication is to treat these credentials as production controls, not implementation details.

For practitioners

• Map the NHI estate separately Build a machine-identity inventory that distinguishes service accounts, automation credentials, tokens, and other non-human identities from human users and admin accounts.
• Assign lifecycle ownership Name an accountable owner for each NHI class and define who approves creation, who reviews usage, and who removes it when the workload or system changes.
• Review privileged NHI access patterns Identify where non-human identities hold elevated access in infrastructure, automation, and AI workflows, then classify which privileges are permanent rather than task-bound.
• Tie automation to identity governance Require every software defined infrastructure or orchestration layer to document the identities it creates, the credentials it uses, and the business owner responsible for them.
• Extend AI governance to credentials Include the tokens, keys, and service identities used by AI-enabled workflows in governance reviews so machine-led operations do not sit outside control scope.

Key takeaways

• Non-human identities have become a governance problem because their scale, ownership complexity, and lifecycle patterns no longer fit human-centric IAM processes.
• Software defined infrastructure and AI both multiply machine identities, which expands the control surface faster than manual governance can keep up.
• The response is not to extend user-account processes unchanged, but to build NHI-specific inventory, ownership, and lifecycle controls into IAM and IGA.

Key terms

• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Software Defined Infrastructure: Software defined infrastructure is an operating model where infrastructure behaviour is controlled by code, policy, and automation rather than manual administration. For identity teams, it matters because every automated layer can create, consume, and depend on non-human credentials that must be governed as part of the control plane.
• Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
• Machine Credential: A machine credential is a secret or identity artifact used by software rather than a person. It includes service account credentials, API keys, tokens, and certificates. In practice, the main risk is not just exposure, but unmanaged lifecycle, unclear ownership, and overbroad access.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.