Runtime discovery expands the set of non-human identities that can be invoked without prewired orchestration, so the control problem shifts from static workflow design to access exposure. The more agents the orchestrator can surface, the harder it becomes to prove which identities were available, which were used, and whether that exposure matched policy.
Why runtime discovery changes the governance model
Runtime discovery is not just another way to find agents. It changes when governance happens. Instead of approving a fixed set of non-human identities and workflows ahead of time, the orchestrator can expose more identities during execution, which makes policy enforcement dependent on what is surfaced in the moment, not only what was designed into the system.
That shift matters because governance is then tied to dynamic access exposure. A team can no longer rely on a static registry alone; it needs to know which agents can appear, under what trust conditions, and whether their runtime availability matches the approved control boundary.
When discovery is broad, the practical question becomes whether each surfaced identity is discoverable, attributable, and bounded before it can act. That is a harder governance problem than simply checking whether the workflow diagram was approved.
What makes runtime discovery harder to govern
Runtime discovery increases the number of identities a control plane may need to recognise, evaluate, and constrain on demand. That creates ambiguity around ownership, lifecycle state, and policy scope, especially when discovery is driven by orchestration logic rather than a predeclared inventory. The result is more places for orphaned, excessive, or undocumented access to hide.
It also weakens evidence quality. If an orchestrator can surface agents dynamically, teams must prove not only that access existed, but that the right identity was exposed at the right time for the right reason. That is materially different from validating a fixed service account or a known integration path.
For NHI teams, the governance burden often lands in NHI lifecycle management, because runtime discovery makes provisioning, rotation, and offboarding less visible if the discovered identities are not already mapped to owners and policy. It also increases the importance of NHI Ownership and Accountability Guide, since unclear ownership becomes a control failure when runtime exposure expands faster than human review can track.
Why the control problem becomes an access problem
Runtime discovery moves the issue from design-time approval to access-time decisioning. The main governance question is no longer, “Was the workflow approved?” It becomes, “Which identities were eligible to be surfaced, who authorised that exposure, and could the orchestrator prove the access path stayed inside policy?”
That is why discovery must be aligned to identity governance, not treated as a convenience feature. If the orchestrator can surface additional agents without a corresponding access policy, the system can drift into overexposure even when each individual action seems technically valid. The risk is cumulative: more surfaced identities mean more opportunities for privilege creep, weak segregation, and undocumented reuse.
Practitioners should connect discovery to Service Account Security and Human vs Non-Human Identity because runtime discovery often exposes the boundary where delegated human intent and machine execution blur. That boundary is where governance errors usually surface first.
Risk and Threat Considerations
Runtime discovery creates exposure when the orchestrator can surface more non-human identities than the governance model can inventory or validate in real time. That can lead to unauthorised tool access, excessive privilege, or policy blind spots, especially if discovered identities inherit trust from the runtime rather than from explicit approval.
Failure mechanism: Dynamic surfacing bypasses static review points, so identities can become usable before owners, scopes, or approval boundaries are fully verified.
Impact: Teams may lose the ability to prove access legitimacy, contain blast radius, or show that a surfaced identity stayed within approved policy, which increases audit, security, and accountability risk.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack surface, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Runtime discovery can surface identities with excessive access beyond intended policy. |
| NHI-01 — Improper Offboarding | Runtime-discovered identities can persist without clear retirement or ownership. | |
| NHI-02 — Secret Leakage | Discovery often expands exposure of credentials or tokens that activate surfaced identities. | |
| Recommendation — Constrain surfaced identities to least privilege and review any discovered overreach before allowing use. Tie discovery to offboarding and ownership checks so dormant identities cannot remain exposed. Inventory and rotate identity-enabling secrets before discovery exposes them at runtime. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Discovery changes who exists in the active access set and demands accountable lifecycle control. |
| IA-5 — Authenticator Management | Runtime discovery often depends on secret or token material that must be controlled tightly. | |
| AU-2 — Event Logging | Governance risk rises when teams cannot prove which identities were surfaced and used. | |
| Recommendation — Require each runtime-surfaced identity to be registered, owned, and lifecycle-managed. Manage, rotate, and revoke authenticators for discovered identities on a defined schedule. Log discovery events and downstream use so access exposure is auditable after the fact. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Runtime discovery directly affects who may be surfaced and allowed to act. |
| A.5.16 — Identity management | Discovery depends on knowing which non-human identities exist and who owns them. | |
| A.8.2 — Privileged access rights | Runtime-surfaced agents may gain powerful permissions if discovery is not constrained. | |
| Recommendation — Define access rules for discovery so surfaced identities remain policy-bound. Maintain an authoritative identity register for every discovered non-human identity. Review and minimise privileged rights before enabling runtime discovery at scale. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions Management | Runtime discovery changes the access set and must stay policy-aligned. |
| Recommendation — Continuously manage permissions for identities surfaced by the orchestrator. | ||
Practitioner Guidance
What to verify: Treat runtime discovery as an access-control feature, not just an inventory feature. Verify that every surfaced identity maps to an owner, a lifecycle state, and an explicit policy decision before it can invoke tools or other agents.
Common mistake: Teams often instrument discovery well but fail to bind it to reviewable governance evidence. If you cannot answer which identities were available, which were used, and why they were eligible, the control is not yet mature enough for broad production use.
What good looks like: Discovery is constrained by policy, surfaced identities are attributable in logs, and exceptions are rare, time-bound, and reviewable. In that state, runtime discovery adds flexibility without turning the orchestrator into an uncontrolled identity broker.
Practitioner takeaway: Runtime discovery is acceptable only when the governance model can keep pace with the identities it exposes; otherwise, the discovery layer becomes the source of uncontrolled access rather than the mechanism that enables safe automation.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 7, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org