Notifications
Clear all
Topic starter
14/08/2026 6:35 pm
TL;DR: Static NHI inventories miss the control question that matters most: which credentials are active now, which agent is using them, and whether granted scope matches real usage, according to Island’s analysis. Runtime telemetry, gateway enforcement, and human ownership tracing change the governance model, but they do not eliminate NHI sprawl.
NHIMG editorial — based on content published by Island: An Identity for Every Agent. A Live Picture of Every Identity
By the numbers:
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
- Only 5.7% of organisations have full visibility into their service accounts.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: What breaks when NHI governance relies on inventory alone?
A: Inventory alone tells you what credentials exist, but not whether they are active, over-scoped, shared, or being used by an agent at runtime.
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation.
Q: How do security teams know if NHI controls are actually working?
A: Look for complete inventory coverage, clear ownership, enforced rotation, and evidence that unused credentials are removed on time.
Practitioner guidance
- Correlate inventory with runtime telemetry Join identity records to endpoint, network, and tool-call telemetry so teams can see which service accounts, API keys, and OAuth grants are actually active.
- Map every discovered NHI to an accountable owner Require a human or team owner for each service account, token, and agent-facing credential, even when the owner is inferred from system context.
- Scope access by task, not by credential lifetime Where agent workflows are involved, issue access through a control point that can constrain actions to the current task and cut off the path without touching unrelated systems.
What's in the full article
Island's full blog covers the operational detail this post intentionally leaves for the source:
- How the Island MCP Gateway sits between agents and tools to control authentication flow.
- How Island correlates endpoint, network, and API telemetry back to specific non-human identities.
- How the product identifies local credentials embedded in files and configs on developer machines.
- How access can be cut off at the gateway without rotating the underlying application credential.
👉 Read Island's analysis of runtime NHI visibility and agent governance →
NHI runtime visibility: are your controls keeping up?
Explore further
14/08/2026 6:42 pm
Runtime identity visibility is now the control boundary, not a reporting feature. The problem this article surfaces is that inventory-only tooling cannot answer whether an NHI is active, over-scoped, or being used by an agent right now. That makes runtime correlation the decisive layer for NHI governance, because existence without behaviour is not enough to manage blast radius. Practitioners should treat runtime observation as the evidence layer that closes the gap between issuance and use.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
A question worth separating out:
Q: Who is accountable when an AI agent exposes credentials or changes identity state?
A: Accountability should sit with the business owner of the agent, the identity team that granted scope, and the control owner responsible for the affected workflow. If the agent touched privileged systems, incident handling should follow the same seriousness as any privileged access failure, because the issue is not just misuse but governance collapse across the identity layer.
👉 Read our full editorial: Runtime NHI visibility is not enough for agent governance
