Notifications
Clear all
Topic starter
12/07/2026 12:19 pm
TL;DR: NHI risk long predates AI, but cloud sprawl, shadow AI, and agent behaviour have made weak credential governance impossible to ignore, according to Clarity Security. Ownership, observability, and runtime enforcement are emerging as the core controls, and the governing assumption that prompts and static permissions can constrain agent actions has collapsed.
NHIMG editorial — based on content published by Clarity Security: Beyond Human: NHI and AI Identity Governance
By the numbers:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.
Questions worth separating out
Q: How should security teams govern AI agents that choose tools at runtime?
A: Security teams should treat runtime tool choice as a governed access event, not a normal application call.
Q: Why do AI systems create NHI governance problems?
A: AI systems often rely on service accounts, tokens, APIs, and delegated permissions that behave like non-human identities.
Q: What breaks when ownership for an agent is tied to the person who built it?
A: Accountability becomes fragile the moment that person changes role, leaves, or loses context.
Practitioner guidance
- Inventory every agent and NHI in one control plane Map each identity to owner, credential source, allowed tools, and downstream systems before expanding deployment.
- Separate ownership from IAM administration Assign business ownership to the product or workload team, then make IAM responsible for lifecycle enforcement, review, and revocation.
- Enforce access at runtime, not in prompts Require a policy decision at the moment an agent attempts a sensitive action, and only grant ephemeral credentials for that specific step.
What's in the full article
Clarity Security’s full webinar covers the operational detail this post intentionally leaves for the source:
- The discussion on unified governance across human, non-human, and agent identities, including how observability should be structured.
- The runtime enforcement examples behind the PocketOS reference, including how access decisions should be made at execution time.
- The ownership model debate for AI agents, including how accountability should be assigned across product and IAM teams.
- The practical board-level framing for explaining data exfiltration, production incidents, and competitive exposure.
👉 Watch Clarity Security’s webinar on AI agent and NHI identity governance →
AI agent governance and NHI observability: what teams should change?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
12/07/2026 12:33 pm
Runtime instruction is not runtime control: Prompt guidance was designed for systems that follow human-authored intent, not for actors that select actions at execution time. That assumption fails when an agent can choose tools, expand scope, and complete actions without a human approval gate. The implication is that security programmes must stop treating prompt text as a governance boundary and start treating runtime authorisation as the boundary.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
A question worth separating out:
Q: Who is accountable when an AI agent causes a security incident?
A: Accountability should sit with the business owner, the system owner, and the security function together, because agent behaviour crosses operational boundaries. Organisations need a defined owner for approval, monitoring, and retirement, plus audit evidence that shows what the agent accessed and why.
👉 Read our full editorial: AI agent and NHI governance need runtime enforcement, not prompts
