Topic starter
11/06/2026 11:22 pm
TL;DR: Distributed systems need decoupled, context-aware authorization because service-to-service trust, on-behalf-of requests, and AI agents all expand the attack surface beyond user-centric IAM, making workload identity and policy enforcement essential, according to Cerbos. The key shift is that authorization now has to govern every non-human actor as a first-class identity, not just the user behind the request.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “Zero-Trust for microservices, a practical blueprint”.
Key questions
Q: How should security teams implement zero-trust authorization for microservices?
A: Security teams should evaluate every internal request with policy, not perimeter trust, and base decisions on the calling workload, the resource, and any delegated user context.
Q: Why do service-to-service calls increase lateral movement risk?
A: Because internal calls often inherit implicit trust, which means a single compromised service can reach adjacent systems without a fresh authorisation decision.
Q: What breaks when on-behalf-of requests are not authorised separately?
A: Delegated requests blur the line between what the service can do and what the user should be able to do.
Practitioner guidance
- Define workload identities for every service and agent Issue each service, bot, or AI agent a unique identity and stop relying on shared network trust or inherited application credentials.
- Separate caller identity from user identity in policy Write rules that evaluate the calling workload and the end-user context together for delegated requests, especially in on-behalf-of flows.
- Enforce least privilege at the authorization layer Restrict each workload to the smallest action set needed for its role, and keep those rules outside application code so they remain auditable.
Bottom line: Distributed applications now need workload-level authorization because internal calls can no longer be assumed safe by default.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
12/06/2026 8:00 am
Workload identity is now the control plane for distributed trust: once services, serverless functions, and agents can initiate actions independently, user-centric IAM stops being enough. Authorization has to follow the workload, not only the end user, because the workload is the actor that actually reaches the resource. Practitioners should treat service identity as a first-class governance domain, not an implementation detail.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security teams govern AI agents that call APIs instead of using a UI?
A: Security teams should govern AI agents by treating each callable action as a scoped entitlement, not as a general application login. The key control is to limit which APIs, data sources, and write actions the agent can chain together in one session. That keeps machine-paced behaviour inside a reviewable boundary instead of relying on human-style session assumptions.
👉 Read our full editorial: Zero-trust workload identity for microservices and AI agents
This post was modified 5 days ago by NHI Mgmt Group