Topic starter
19/08/2026 3:25 pm
TL;DR: NHIs outnumber human users 45:1 in large enterprises, and Saviynt argues that human-centric IGA breaks down when AI agents and non-human identities operate continuously across business applications, cloud, and SaaS. The core issue is not just scale, but the collapse of joiner-mover-leaver assumptions when identities can appear, change, and disappear within minutes or hours.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “Governing Non-Human and AI Identities Inside Business Applications”.
By the numbers:
- Today, NHIs outnumber human users 45:1 in large enterprises, and the gap is widening.
Key questions
Q: What breaks when non-human identities are managed with human joiner-mover-leaver processes?
A: Human lifecycle models assume a person has a start date, role changes, and an offboarding event.
Q: Why do unstructured non-human identities create more risk than managed applications?
A: Unstructured identities are harder to discover, monitor, and govern than managed applications.
Q: How do teams know if NHI governance is actually working?
A: Look for complete inventory coverage, clear ownership, enforced rotation, and reliable decommissioning.
Practitioner guidance
- Map every non-human identity to a named business owner Require ownership for service accounts, bots, and AI agents before they are allowed to touch production applications.
- Replace periodic reviews with event-based governance triggers Trigger recertification when an NHI is created, delegated, expanded, or retired, rather than waiting for quarterly or annual review cycles that miss machine-speed change.
- Assess cross-application privilege combinations Review the combined access footprint across SAP, Oracle, Salesforce, ServiceNow, Workday, cloud services, and SaaS so that hidden SoD conflicts do not remain invisible inside separate application teams.
Bottom line: Human-centric joiner-mover-leaver controls do not translate cleanly to service accounts, bots, and AI agents that do not follow employee lifecycle events.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:09 pm
Human-centric IGA is now a partial control plane, not a complete one. It still has value for joiner-mover-leaver governance, but only for identities that behave like people. The moment the governed subject is a service account, bot, or AI agent, the operating assumptions change: no HR lifecycle, no stable manager, and no useful quarterly review cadence. Practitioners should stop treating human IGA as the default model for all identities.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should IAM teams govern AI-assisted identity workflows?
A: Treat AI-assisted identity workflows as governed control paths, not simple productivity tools. Define which tasks the assistant may recommend, draft, or execute, then keep approval rights and exception handling with named humans. The essential control is traceability, so every machine-generated action can be reviewed, challenged, and linked back to a responsible operator.
👉 Read our full editorial: Governing NHI and AI identities inside business applications