How should teams govern non-human identities their IAM system cannot see?

Identity lineage is the governance primitive that IAM never fully modelled for NHIs. Traditional IAM assumes the identity record and the accountable person are the same thing. That assumption breaks once service accounts, API keys, and AI agents are created and consumed outside the user lifecycle. The practical implication is that governance has to follow relationships, not just identities.

A few things that frame the scale:

• DeepSeek alone generated 113,000 new exposed API keys in 2025, illustrating how new AI providers create credential exposure before security guardrails catch up, according to the State of Secrets Sprawl 2026.
• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.

A question worth separating out:

Q: Should organisations treat service accounts and AI agents under the same authorization model?

A: Yes. Service accounts, AI agents, and other workloads are all non-human principals that need centrally governed access decisions, even if their runtime behaviour differs. Treating them under one authorization model reduces blind spots, exposes overprivilege faster, and gives security teams a common way to enforce least privilege across delegated machine identity.

👉 Read our full editorial: Identity lineage is the missing control for non-human identities