Topic starter
17/08/2026 4:41 pm
TL;DR: Akeyless argues that machine identities now outnumber humans by orders of magnitude, and that APIs, tokens and keys cannot be governed safely with blanket permissions or infrequent revocation alone. The shift is toward action-based authentication, just-in-time access and tighter API validation as baseline controls, not optional hardening.
Editorial analysis by NHI Mgmt Group, based on content published by Akeyless: “Tackling Identity Management Challenges at Scale: Insights from Adam Arellano, Advisor at Traceable”.
Key questions
Q: What breaks when a machine identity has more access than it needs?
A: Overprivileged machine identities turn a single credential compromise into lateral movement, data access, and configuration change.
Q: How should privacy teams implement CPRA controls in cloud and API environments?
A: Start by mapping where personal and sensitive personal information actually moves, then enforce purpose-based access and traceable rights workflows across those paths.
Q: How do security teams know whether machine identity governance is working?
A: They know it is working when every non-human credential has a named owner, a visible system scope, and a documented retirement path.
Practitioner guidance
- Map machine identity scope to specific actions Inventory which service accounts, API keys and tokens are allowed to do which operations, then remove broad entitlements that are not tied to a named business action.
- Replace blanket permissions with just-in-time access Use ephemeral access for high-risk machine operations so credentials are not permanently available for reuse across unrelated workflows.
- Tighten API request validation Check that every privileged API call is authorised for the exact object, function and context it is attempting to reach, not just for the identity that submitted it.
Bottom line: Machine identity scale makes broad, persistent permissions unsafe because one credential can govern too many repeated actions across APIs and services.
What's in the full article
Akeyless's full article covers the operational detail this post intentionally leaves for the source:
- The interview context with Adam Arellano’s security career background and how it shapes his view of identity governance
- The discussion of how security and development teams should collaborate around CI/CD pipelines and key management systems
- The article’s plain-language examples of revocation, validation and workflow simplification for practitioners
- The closing vendor perspective on simplifying tool sprawl and unifying secrets and machine identity management
👉 Read Akeyless’s discussion of machine identity scale and action-based authentication →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:46 pm
Action-based authentication is the right response to machine identity scale because static grants no longer match machine behaviour. When APIs, services and automation platforms operate continuously, a permission model built around one-time issuance becomes too coarse to govern safely. The practitioner takeaway is that access decisions must move closer to the moment of execution, where intent and scope are still observable.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between action-based authentication and traditional machine access control?
A: Traditional machine access control usually authenticates the identity once and then trusts the resulting session or token for multiple actions. Action-based authentication re-checks whether the specific operation is allowed at the moment it is attempted, which reduces reuse of overbroad credentials.
👉 Read our full editorial: Machine identity scale is forcing action-based authentication models