Topic starter
02/09/2026 1:29 pm
TL;DR: Machine identities already outnumber human identities in many environments, and SSH Communications Security says AI agents are accelerating the move from privileged users to privileged actions. The key governance shift is using short lived certificates plus context aware authorisation so access exists only for the task, not as a reusable standing secret.
Editorial analysis by NHI Mgmt Group, based on content published by SSH Communications Security: “A Closer Look at Ephemeral Certification”.
Key questions
A: They should treat workloads and AI systems as governed non-human identities, not as technical exceptions.
Q: Why does ephemeral certification reduce risk for machine identities?
A: It reduces the lifetime of reusable secrets and narrows the time window in which a credential can be stolen or replayed.
Q: What are the signs that privileged access governance is still account-centric?
A: Look for policies that review roles but not individual actions, long-lived credentials that remain valid between tasks, and approval workflows that do not capture request context.
Practitioner guidance
- Map privileged actions, not just privileged accounts Inventory the specific system actions AI agents, workloads and administrators are allowed to perform, then define policy around those actions rather than broad role labels.
- Replace reusable secrets with short-lived credentials Issue ephemeral certificates or equivalent short-lived credentials for task-scoped access so the credential expires when the task ends and cannot be reused as standing privilege.
- Add request-time context to authorisation Evaluate who or what is requesting access, which resource is needed, which action is permitted and whether the request satisfies policy before issuing the credential.
Bottom line: The article argues that privileged access governance is shifting from managing static accounts to governing task-scoped actions across humans, workloads and AI agents.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
02/09/2026 1:30 pm
Ephemeral certification is really a control over privilege persistence. Short-lived certificates matter because they reduce the time window in which a credential can be misused or replayed. The central issue is not certificate format, but whether access can outlive the task it was meant to serve. For IAM and PAM teams, that shifts attention from credential storage to issuance, scope and expiration.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
A: Yes, because zero standing privilege directly addresses the highest-risk failure mode in agentic systems: persistent access that outlives the task. Broader IAM modernisation matters, but agent governance starts where privilege is issued, not where it is later reviewed.
👉 Read our full editorial: Ephemeral certification and AI agents are reshaping privileged access
This post was modified 1 day ago by NHI Mgmt Group