Topic starter
22/06/2026 10:02 am
TL;DR: Zero trust breaks down for service accounts, API keys, OAuth tokens, IAM roles, secrets, and AI agents when the underlying identity is invisible, unowned, or over-permissioned, according to Oasis Security. The governance gap is no longer theoretical: policy enforcement without identity ownership and lifecycle control cannot secure machine-to-machine traffic.
Editorial analysis by NHI Mgmt Group, based on content published by Oasis Security: “Extending Zero Trust to Non-Human & Agentic Identities”.
Key questions
Q: What breaks when Zero Trust is implemented without identity governance?
A: Zero Trust breaks when the policy engine is enforcing stale or incomplete identity data.
Q: Why do service accounts and tokens create a different zero trust problem than human users?
A: Because their identity state is often opaque, unowned, or long lived.
A: Security teams should pair continuous machine identity with threat detection so every machine connection is verified before it is trusted.
Practitioner guidance
- Map every non-human identity to an owner Build an inventory that ties service accounts, API keys, OAuth tokens, IAM roles, secrets, and agents to a named operational owner and a revocation path.
- Rotate and revoke on lifecycle events Trigger secret rotation, credential revocation, and access review when an identity becomes stale, orphaned, over-privileged, or no longer tied to a valid use case.
- Bind enforcement decisions to identity context Feed ownership, risk score, and access scope into inline policy so the control plane can evaluate more than source, destination, and protocol.
Bottom line: Zero trust fails as a complete governance model when non-human identities are unowned, invisible, or carry standing access that outlives the business need.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 10:44 am
Zero trust for non-human identity fails when identity is not governable. The article is right to frame the problem as an assumption collapse, not a tuning issue. Zero trust presupposes that the subject of policy is known, accountable, and lifecycle-managed, but service accounts, API keys, OAuth tokens, IAM roles, and AI agents often are not. Practitioners should treat this as a boundary problem in identity architecture, not a network-policy gap.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between enforcing policy inline and governing the identity behind it?
A: Inline enforcement decides whether a live request should pass. Identity governance decides what that identity is allowed to exist with over time, who owns it, and when its access should be rotated or removed. Both are required for zero trust in non-human environments, but they solve different control problems.
👉 Read our full editorial: Extending zero trust to non-human and agentic identities