Topic starter
16/04/2026 6:33 pm
TL;DR: AI agents are accumulating credentials faster than security teams can track them, with some organisations reporting 20:1 NHIs to humans and 95% or more of NHIs lacking an assigned owner, according to Lumos. The spare key problem shows that identity governance, not another authentication layer, is what determines whether access stays accountable.
Editorial analysis by NHI Mgmt Group, based on content published by Lumos: “Why Humans and Agents Must Be Governed Together: The Spare Key Problem”.
Key questions
Q: What breaks when machine credentials in AI platforms have no clear owner?
A: Offboarding, incident response, and entitlement cleanup all slow down when no one is accountable for a token or service account.
Q: Why do service accounts and bots create more governance risk than many human accounts?
A: Service accounts and bots create more governance risk because they are often granted privileges for speed and left in place after the original use case changes.
Q: How can organisations tell whether NHI governance is actually working?
A: NHI governance is working when every machine identity has an owner, a purpose, a minimum-necessary entitlement, and evidence of rotation and review.
Practitioner guidance
- Map every credential to a named owner Require an accountable human owner for every service account, OAuth grant, and AI agent token, and revoke or reassign any credential that cannot be tied to a responsible person or team.
- Attach business purpose at issuance Record the stated intent for each credential when it is approved so review teams can judge whether current usage still matches the reason access was granted.
- Treat unowned access as a defect Create a queue for any NHI record with no owner, no purpose, or no renewal path, and escalate those records as governance failures rather than routine cleanup.
Bottom line: The article shows that the real identity risk is not weak authentication, but access that survives after its original purpose and owner have faded.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
11/10/2026 6:10 am
Identity governance is now a cross-actor discipline, not a human-only process. The article correctly identifies that every agent traces back to a person or team that authorised it, which means ownership is a relationship problem as much as an access problem. When that relationship is split across different systems, orphaned access becomes the default state. The practitioner implication is that governance models must treat human and non-human identities as one accountability chain.
A few things that frame the scale:
- 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
A question worth separating out:
Q: What should organisations do when a human leaves but an agent or service account remains?
A: Treat that as a full offboarding event for the associated access chain, not just the human account. The agent, delegated scopes, and any downstream service accounts should be reviewed together, because the human departure can leave intact a set of credentials that still have working access but no current accountability.
👉 Read our full editorial: Why human and agent identities need unified governance