Topic starter
09/06/2026 11:05 pm
TL;DR: Access governance is increasingly measured across mixed identity populations, not just named users, according to Cerbos. It settled on monthly active principles as a pricing metric because it better captures the unique identities interacting with authorization, including humans and machines, while preserving predictability for enterprise buyers.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “The Business of Open Source podcast: From open source to enterprise, Alex Olivier on Cerbos' evolution”.
Key questions
Q: How should IAM teams count identities when access is used by both people and machines?
A: Count every distinct identity that receives authorization decisions, not just named users.
Q: Why do user-based access metrics break down in mixed identity environments?
A: User-based metrics assume the main governance burden comes from people, but many modern authorization systems are consumed by software identities as well.
A: Activity volume measures traffic, not governed access.
Practitioner guidance
- Map your authorization population Inventory every identity type that consumes access decisions, including employees, contractors, service accounts, workload identities, and delegated tokens.
- Separate identity count from activity volume Do not let API calls, request traffic, or data transfer become your primary measure of authorization scope.
- Align lifecycle ownership to machine identities Assign explicit owners for non-human identities so that rotation, offboarding, and access review do not disappear into platform administration.
Bottom line: Monthly active principles are a better governance lens than user counts when access decisions are made for both people and machines.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
10/06/2026 1:17 am
Monthly active principles is a more honest identity metric than monthly active users. Once machine identities enter the access model, user-only counting stops describing the real governance surface. Service accounts, workloads, and automated actors all create policy decisions, audit burden, and lifecycle overhead, so the relevant unit is the identity that consumes control, not the person who owns the account. Practitioners should treat identity populations as mixed by default.
A few things that frame the scale:
- Organizations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: How do organisations know if their identity metrics are actually useful?
A: A useful metric is one that a security lead, platform owner, and finance team can all calculate the same way without guessing. If it cannot forecast audit load, entitlement growth, or support effort, it is probably too abstract to guide governance or pricing decisions.
👉 Read our full editorial: Cerbos pricing shows why monthly active principles fit identity governance
11/06/2026 12:23 am
Monthly active principles is a more honest identity metric than monthly active users. Once machine identities enter the access model, user-only counting stops describing the real governance surface. Service accounts, workloads, and automated actors all create policy decisions, audit burden, and lifecycle overhead, so the relevant unit is the identity that consumes control, not the person who owns the account. Practitioners should treat identity populations as mixed by default.
A few things that frame the scale:
- Organizations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: How do organisations know if their identity metrics are actually useful?
A: A useful metric is one that a security lead, platform owner, and finance team can all calculate the same way without guessing. If it cannot forecast audit load, entitlement growth, or support effort, it is probably too abstract to guide governance or pricing decisions.
👉 Read our full editorial: Cerbos pricing shows why monthly active principles fit identity governance
12/06/2026 1:55 am
Monthly active principles are a useful proxy for access governance because they count the identities that actually consume authorization decisions. The article shows why user-based pricing can miss the real operational unit once machines, services, and delegated identities participate in the same control plane. That is not a billing nuance; it is a signal that identity programmes need a population model, not just a person model. Practitioners should use the same logic when scoping entitlement review and audit coverage.
A few things that frame the scale:
- Software supply chain attacks were projected to cost organisations $60 billion in 2025.
A question worth separating out:
Q: Should organisations manage human and machine identities under the same access governance model?
A: They should govern them under the same programme, but not with identical controls. The shared requirement is visibility into who or what is authorised. The difference is that machine identities usually need tighter ownership, shorter lifecycle expectations, and clearer operational handoff. A single programme works best when it distinguishes subject type while keeping one governance record.
👉 Read our full editorial: Cerbos pricing shows why monthly active principles fit identity governance
This post was modified 6 days ago by NHI Mgmt Group