Topic starter
15/08/2026 6:07 pm
TL;DR: 100:1 is the ratio Britive uses to show why vault-centric PAM stops fitting non-human identity growth, based on its case work. Runtime-scoped access for short-lived agents cannot be handled as a standing credential.
Editorial analysis by NHI Mgmt Group, based on content published by Britive: “Your NHI Population is About to 100x. Your Vault Was Only Built to Handle 10x.”.
Key questions
Q: Why does per-call policy evaluation reduce risk for ephemeral agents?
A: Per-call policy evaluation shifts trust to the exact moment an agent tries to act, so access is granted only for a specific request and resource context.
Q: What signs show that an NHI programme is still built around standing access?
A: The clearest sign is when teams can inventory identities and rotate secrets, but cannot explain how short-lived agents are authorised at the moment of tool use.
Q: What breaks when organisations try to manage agentic AI with vault-centric PAM?
A: Vault-centric PAM assumes an identity persists long enough for credential issuance, storage, and reuse to make sense.
Practitioner guidance
- Inventory agentic identities already in use Include copilots, embedded SaaS assistants, and other runtime-created agents that teams can stand up without a formal procurement path.
- Classify the agent identity model explicitly Decide whether each agent inherits user policy, binds to a distinct identity, or acts through a delegated service account before projects diverge.
- Move high-value use cases to per-call evaluation Prioritise agents touching support cases, CRM data, security tooling, and finance workflows where runtime authorization can replace standing access.
Bottom line: The article argues that the problem is not simply more NHI volume, but a shift to short-lived agentic identities that old PAM models were not designed to govern.
Glossary terms: Dynamic Ephemeral Identity, Standing Credential, Per-Call Policy Evaluation, Zero Standing Privilege
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 12 hours ago by NHI Mgmt Group
15/08/2026 6:16 pm
Ephemeral access breaks the standing-credential premise: Vault-centric PAM was designed for identities that persist long enough to justify storing and rotating secrets. That assumption fails when the actor is an agentic identity because access is created at runtime, used briefly, and discarded before a vault workflow can add value. The implication is not just larger scale. It is that the governance object has changed, and the old lifecycle logic no longer describes it.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
A question worth separating out:
Q: How should IAM teams govern agents that are instantiated by users on demand?
A: Treat them as a separate governance population with explicit runtime authorization, scoped tool access, and task-bound expiry. Do not let individual projects invent their own model, because inconsistent delegation quickly creates audit gaps and uneven blast radius across the estate.
👉 Read our full editorial: Why vault-centric PAM breaks as NHI populations cross 100:1