Notifications
Clear all
Topic starter
19/08/2026 3:25 pm
TL;DR: NHIs outnumber human users 45:1 in large enterprises, and Saviynt argues that human-centric IGA breaks down when AI agents and non-human identities operate continuously across business applications, cloud, and SaaS. The core issue is not just scale, but the collapse of joiner-mover-leaver assumptions when identities can appear, change, and disappear within minutes or hours.
NHIMG editorial — based on content published by Saviynt: Governing Non-Human and AI Identities Inside Business Applications
By the numbers:
- NHIs outnumber human users 45:1 in large enterprises, and the gap is widening.
- Only 5.7% of organisations have full visibility into their service accounts.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
Questions worth separating out
Q: How should security teams govern AI agents and NHIs differently?
A: Security teams should govern NHIs as predictable machine identities and AI agents as runtime actors that can alter behaviour after authentication.
Q: Why do NHIs make access review harder than human identity review?
A: NHIs often exist in more places than a human account and can be created or copied without a clear lifecycle record.
Q: What breaks when identity governance is built only for human users?
A: Access review, joiner-mover-leaver processes, and periodic certification break down when the identity is a service account or autonomous agent.
Practitioner guidance
- Build a single governed inventory for humans, NHIs, and AI agents Map identities to business owners, application scope, and lifecycle status across ERP, CRM, ITSM, SaaS, cloud, and workflow tools.
- Replace calendar-based review cycles with event-driven certification triggers Trigger review when an identity is created, delegated, repurposed, or linked to a new application instead of waiting for quarterly recertification.
- Analyze effective access across applications, not entitlement by entitlement Assess SoD risk by combining access across SAP, Oracle, Salesforce, ServiceNow, and connected services.
What's in the full article
Saviynt's full blog post covers the operational detail this post intentionally leaves for the source:
- How the vendor maps human, non-human, and AI identities across business applications and workflow systems
- The control patterns it describes for continuous visibility, ownership assignment, and policy enforcement
- The application-access governance framing used to explain SoD risk across SAP, Oracle, Salesforce, ServiceNow, and Workday
- The vendor's view of how continuous monitoring fits into audit readiness and automation adoption
👉 Read Saviynt's analysis of governing NHI and AI identities inside business applications →
NHI and AI identities in business apps: what IAM teams need now?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
19/08/2026 4:09 pm
Human-centric governance is the wrong operating model for NHI and AI identities. Joiner-mover-leaver controls were designed for people with employment records, managers, and predictable lifecycle events. That assumption fails when identities are created by workflow logic, delegated across systems, or retired without human action. The implication is that identity governance must stop treating non-human and AI actors as exceptions and begin treating them as primary governed subjects.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: Who should be accountable for AI identity governance?
A: Accountability should sit with the team that owns the workflow and the team that owns identity controls, because AI access crosses both domains. Security, platform, and application owners each hold part of the lifecycle, but one business owner must remain responsible for the access decision and its removal.
👉 Read our full editorial: Governing NHI and AI identities inside business applications
