Accountability sits with the organisation and the leaders responsible for security, governance, and compliance, not just the technical team. Teams should keep evidence of access policies, approval decisions, provisioning and deprovisioning actions, audit logs, and incident response records. That evidence shows whether controls were designed, enforced, and monitored as required.
Why This Matters for Security Teams
Under EU NIS2 Directive, access control failure is not treated as a narrow IAM defect. It becomes a governance issue because the organisation must show that controls were designed, operated, and reviewed with due care. That means accountability reaches beyond the engineer who made the change and up to the leaders responsible for security, risk, and compliance. Evidence matters because regulators and auditors look for proof, not reassurance.
For NHI-heavy and agentic environments, this is even more important. A compromised secret or over-permissive service account can act faster than a human reviewer, as reflected in NHIMG research such as LLMjacking: How Attackers Hijack AI Using Compromised NHIs and Ultimate Guide to NHIs — Regulatory and Audit Perspectives. In practice, many security teams encounter accountability gaps only after an incident shows that approvals, logs, or revocation evidence were never retained in a defensible way.
How It Works in Practice
Teams should treat evidence collection as part of control operation, not as an after-the-fact cleanup task. A defensible record normally shows who approved access, what was approved, when it was provisioned, how long it remained active, and when it was removed. For NIS2, that record should also show that access decisions were aligned with risk management, monitored over time, and escalated when exceptions were granted. The baseline control expectations in NIST SP 800-53 Rev 5 Security and Privacy Controls and OWASP Non-Human Identity Top 10 both point to the same operational need: prove access was intentional, bounded, and reviewable.
For non-human identities, the evidence set should be broader than human IAM tickets because machines often authenticate through secrets, certificates, federated tokens, or workload identity. Keep records for:
- access policies and exception approvals
- provisioning and deprovisioning timestamps
- rotation history for secrets and certificates
- audit logs showing actual use, not just issuance
- alerts, detections, and incident response actions tied to access misuse
NHIMG research on the Ultimate Guide to NHIs is clear that fragmented control ownership is where audit trails decay: security may own policy, platform teams may own provisioning, and application teams may own the workload, but nobody owns the full chain of evidence. These controls tend to break down in fast-moving cloud environments because ephemeral credentials, automated deployments, and unmanaged service accounts outpace manual review.
Common Variations and Edge Cases
Tighter evidence retention often increases operational overhead, requiring organisations to balance audit readiness against storage, privacy, and workflow friction. The practical answer is not to log everything indiscriminately, but to log enough to reconstruct the access decision and prove the control worked. Guidance is still evolving on how much telemetry is sufficient for AI agents and other NHI-driven systems, especially where actions are high-frequency and short-lived.
One common edge case is delegated administration, where a platform team grants access but a product team uses it. Another is emergency access, where an exception is justified but not time-boxed, creating weak accountability later. A third is automated access via agents or pipelines, where a single human approver cannot describe every downstream action. In those environments, current guidance suggests pairing policy-as-code with immutable audit logs and periodic reviews, rather than relying on ticket-only evidence. NHIMG’s 52 NHI Breaches Analysis and the JetBrains GitHub plugin token exposure both show how quickly access misuse becomes an audit problem once tokens or accounts escape their intended scope.
Best practice is to preserve evidence in a form that survives personnel changes and incident review. If a team cannot show who authorised the access, what changed, and when the access was removed, then accountability is usually treated as incomplete under NIS2.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack surface, NIST CSF 2.0 and NIST AI RMF set the technical controls, and NIS2 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-1 | Access control outcomes depend on knowing who is authorized and why. |
| OWASP Non-Human Identity Top 10 | NHI-03 | Non-human access failures often trace back to weak credential governance. |
| CSA MAESTRO | GOV-02 | Agent and workload governance requires clear ownership and traceability. |
| NIST AI RMF | AI systems need governance evidence for decisions, monitoring, and accountability. | |
| NIS2 | Article 21 | NIS2 requires risk management measures and evidence of effective implementation. |
Document access authorization, then verify each entitlement is approved, reviewed, and removed on schedule.
Related resources from NHI Mgmt Group
- Who is accountable when privileged login controls fail to block unauthorised access?
- Who is accountable when identity controls fail under NIS2?
- Who is accountable when VPN-based access controls fail under the Online Safety Act?
- Who is accountable when cyber resilience controls fail under NIS2 and DORA?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
