Topic starter
06/06/2026 2:01 am
TL;DR: Generative AI RAG deployments expand the non-human identity attack surface through service accounts, access keys, SAS tokens, and stale secrets that can expose or poison grounded data, according to Oasis Security. The governance problem is not AI novelty but unmanaged machine access that turns data integrity and privacy into identity control failures.
Editorial analysis by NHI Mgmt Group, based on content published by Oasis Security: “Securing Generative AI with Non Human Identity Management and Governance”.
Key questions
Q: What breaks when RAG applications rely on shared machine credentials?
A: Shared machine credentials collapse ownership, scope, and accountability into one access path.
Q: Why do long-lived NHI secrets create more risk in generative AI workflows?
A: Long-lived secrets outlast the business need they were created for, so compromise or reuse can persist across model sessions, data sources, and projects.
Q: How should security teams implement NHI governance before AI agents scale further?
A: Start with continuous discovery, then add ownership, lifecycle triggers, certification, and escalation.
Practitioner guidance
- Map every RAG data path Inventory the service accounts, access keys, SAS tokens, and service principals that connect AI applications to grounding data, then assign ownership and review cadence for each one.
- Shorten credential lifetime Replace long-lived secrets and broad token scopes with the minimum access window needed for the workload, and remove credentials that remain active after the use case changes.
- Separate read and write access Ensure the identities used to retrieve grounding data are not the same identities allowed to modify that data, especially where AI outputs depend on the integrity of source content.
Bottom line: Generative AI expands identity risk because retrieval depends on machine credentials that can be overprivileged, stale, or widely reused.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 19 hours ago by NHI Mgmt Group
06/06/2026 3:27 am
RAG introduces an identity-governance problem, not just an AI governance problem. The application value comes from machine access to external data, which means the control point is the non-human identity estate behind retrieval. That shifts the burden from model oversight to entitlement scope, secret lifecycle, and monitoring of data paths. Practitioners should treat generative AI as an identity architecture challenge before it is a prompt engineering problem.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- According to Gartner, worldwide spending on generative AI is set to reach $644 billion in 2025, a nearly 77% year-over-year increase.
A question worth separating out:
Q: Should organisations treat AI model risk and NHI risk as separate programmes?
A: No. Generative AI systems that depend on retrieval or backend automation are only as trustworthy as the non-human identities behind them. Model risk governs output behaviour, but NHI governance governs who can feed, change, or expose the data that shapes those outputs.
👉 Read our full editorial: Securing generative AI requires governed non-human identities
This post was modified 19 hours ago by NHI Mgmt Group