Topic starter
30/09/2026 5:00 pm
TL;DR: 91% of production identities are non-human, but the harder problem is that AI agents can operate under human credentials and inherit legitimate sessions that identity providers and SIEMs cannot distinguish from human use, according to ClearVector. That collapses attribution, scope, and incident response unless teams track runtime activity per identity, not just authentication events.
Editorial analysis by NHI Mgmt Group, based on content published by ClearVector: “Is this identity still human? AI agents running under human credentials”.
By the numbers:
- 91% of identities in production are non-human, according to ClearVector's Identity Intelligence Report 2026.
- ClearVector observed AI agents in production at multiple customers in the fourth quarter of 2025.
Key questions
Q: What breaks when an AI agent uses a human's production credential?
A: The assumption that a valid login equals human action breaks immediately.
Q: Why do valid authentication records not prove who acted in production?
A: Because authentication only proves that a credential was presented successfully, not what happened after the session opened.
Q: How can security teams tell whether an AI agent is using the right credential model?
A: Look for three signs: the credential is short-lived, the scope is narrowly bounded to the task, and revocation does not depend on finding secrets in code or logs.
Practitioner guidance
- Map runtime activity to each production credential Correlate actions, timestamps, and touched systems to the specific credential that executed them so you can separate a valid sign-in from machine-driven behaviour.
- Inventory where human access can drive non-human behaviour Identify developer and administrator sessions that can be used by scripts, integrations, or AI agents, then classify those paths as non-human execution risk.
- Separate authentication logs from behavioural evidence Retain the session record, but add per-identity activity records that show what the credential accessed, in what order, and at what rate.
Bottom line: A valid production login no longer proves a human was the actor behind it, because scripts and AI agents can use the same authorised session.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/09/2026 5:00 pm
Authentication is no longer proof of human action. That assumption was designed for a world where a person, and only that person, used the session after login. It fails when an AI agent can inherit the same credential and execute inside the same authorised context. The implication is that identity programmes must separate proof of access from proof of actor behaviour.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
A: Contain based on observed runtime use, not on every account that could theoretically have been available. Preserve the session record, map activity to the specific credential, and rotate or revoke only the identities and systems that show actual exposure. That keeps response narrow enough to be defensible.
👉 Read our full editorial: Human credentials no longer prove human action in production