Topic starter
28/08/2026 12:04 pm
TL;DR: Access certification for non-human identities is still handled ad hoc, leaving service accounts, machine tokens, and API keys active for years without formal oversight, according to SailPoint. The governance gap is not visibility alone, but the assumption that human review processes can be applied to machine-scale access without redesign.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “Bringing access reviews to your non-human identities”.
Key questions
Q: What breaks when access reviews do not include machine and AI identities?
A: Review cycles miss the identities that often move the most data and inherit the most privilege.
Q: Why do certificates create governance issues for non-human identities?
A: Because certificates are often attached to devices, servers, APIs, and service accounts that do not behave like people.
Q: How should IAM teams prioritise which non-human identities to review first?
A: Start with credentials that are orphaned, idle, exposed, non-expiring, former-employee-linked, high-risk, or over-permissioned.
Practitioner guidance
- Define NHI certification scopes by risk signal Build campaigns around orphaned, idle, exposed, non-expiring, former-employee-linked, high-risk, and over-permissioned credentials so reviewers see a bounded set.
- Assign explicit ownership before review begins Require every service account, machine token, and API key in scope to have a named attester or fallback owner before it enters certification.
- Separate easy remediation from owner review Disable idle credentials, reassign obvious ownership, and capture provider-console instructions before escalating unresolved items to developers.
Bottom line: Machine identity access reviews fail when organisations reuse human certification processes without redesigning ownership and expiry assumptions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
28/08/2026 12:04 pm
Human-style certification is the wrong control model for machine identities: access review programmes were designed around people, not service accounts, API keys, and workload tokens. The article exposes a governance gap that appears when reviewers are asked to certify access that has no clear human owner, no HR record, and no natural business narrative. Practitioners should treat that as a control-design problem, not a process exception.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do organisations make NHI access reviews auditable?
A: They need a campaign record that shows who reviewed each credential, what decision was made, what action followed, and when the item closed. That evidence turns certification into a defensible governance control instead of an informal checklist.
👉 Read our full editorial: Access reviews for non-human identities expose the governance gap
This post was modified 1 day ago by NHI Mgmt Group