Topic starter
14/05/2026 12:43 pm
TL;DR: Identity audits built around quarterly access reviews no longer cover shadow NHIs, ephemeral credentials, or AI agents that create and use authority outside registered workflows, according to Astrix Security. The shift is from reviewing identities to proving that authority over every human, machine, and AI entity is continuously effective.
Editorial analysis by NHI Mgmt Group, based on content published by Astrix Security: “The Auditor’s Mindset Shift: Why “Who Has Access?” Is No Longer Enough”.
Key questions
Q: What breaks when organisations rely on manual access reviews for NHIs?
A: Manual access reviews break down when identities are created dynamically and change faster than the review cycle.
Q: Why do NHIs create governance risk even when they are approved?
A: Approved status only proves that a record was reviewed, not that the credential is still bounded in practice.
Q: How do security teams know if NHI governance is actually working?
A: A working NHI programme shows clear ownership, short-lived credentials, frequent revocation, and low numbers of dormant or shared machine accounts.
Practitioner guidance
- Map the full authority surface Inventory every entity that can exercise access, including service accounts, API keys, OAuth tokens, certificates, and AI agents, then compare that inventory with what is enrolled in IGA and PAM.
- Measure effective privilege continuously Track what each authority-bearing entity can actually do in production, not just what a certification campaign assigned on paper, and reconcile drift between assigned and effective access.
- Separate enrollment from authority Treat vault enrollment, access review completion, and real authority as distinct control states so that unmanaged credentials outside the vault are visible as a governance gap.
Bottom line: The article argues that authority, not the identity record, is the right control unit for NHIs and AI agents.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
14/05/2026 12:44 pm
Identity governance is too narrow a construct for machine-era authority. The article correctly exposes the gap between reviewing an identity and proving control over authority-bearing entities. When NHIs, tokens, and AI agents create access outside the review cycle, the old model measures paperwork completion rather than security effect. The practitioner conclusion is that governance must follow authority, not enrollment.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
A question worth separating out:
Q: What is the difference between identity governance and access management for NHIs?
A: Access management decides whether a credential can authenticate and reach a system. Identity governance decides whether that credential should exist, who owns it, what it is allowed to do, and when it must be removed or rotated. For NHIs, governance is the higher-value control because stale access often survives authentication controls.
👉 Read our full editorial: Authority governance is replacing identity governance for NHIs
This post was modified 7 days ago by NHI Mgmt Group