A set of identity design principles introduced by Kim Cameron to improve privacy, trust, and usability. The laws emphasise user control, minimal disclosure, directed identity, pluralism, human involvement, and consistent experiences. They remain a useful framework for evaluating whether identity systems balance security requirements with respectful data handling.
Expanded Definition
The 7 Laws of Identity are a design framework for identity systems that Kim Cameron introduced to improve privacy, trust, and usability. In NHI and IAM contexts, they are best read as architectural guidance rather than a compliance standard, because no single standard governs this yet. Their core value is helping teams decide whether an identity flow collects too much data, reveals too much by default, or centralises control in ways that weaken trust.
The laws are especially relevant when an organisation is designing delegated access, federated login, or machine-to-machine identity patterns that involve tokens, scopes, and consent boundaries. They align naturally with least-privilege thinking in the NIST Cybersecurity Framework 2.0, but they focus more on identity experience and disclosure than on control implementation. In practice, the framework asks whether identity is pairwise and context-sensitive, whether users or operators retain meaningful control, and whether the system respects multiple identity providers without forcing a single trust model. The most common misapplication is treating the 7 Laws as a checklist for authentication features, which occurs when teams copy the language without redesigning disclosure, consent, and federation behavior.
Examples and Use Cases
Implementing the 7 Laws of Identity rigorously often introduces product and integration constraints, requiring organisations to weigh smoother onboarding against stronger privacy boundaries and more complex federation logic.
- A workforce portal uses directed identity so each partner sees only the tenant-specific identifier needed for access, reducing cross-domain correlation risk.
- An AI agent platform applies minimal disclosure so service accounts and tokens expose only the claims required for a specific tool call, not a full human profile.
- A federated customer login flow supports pluralism by accepting multiple identity providers instead of forcing one central directory, which improves reach but complicates governance.
- An operator approval workflow preserves human involvement for high-risk secret rotation, so automated actions still require explicit review before production change.
These patterns matter because identity failures are rarely abstract. In Ultimate Guide to NHIs, NHI Management Group reports that 97% of NHIs carry excessive privileges, showing how quickly identity design drifts away from restraint when controls are not embedded early. The same design discipline is reflected in the broader identity guidance used by the NIST Cybersecurity Framework 2.0, even though the 7 Laws themselves are not a NIST standard. A practical use case appears when a platform must support both employee identities and third-party service identities without merging their trust models into one overexposed account.
Why It Matters in NHI Security
The 7 Laws of Identity matter in NHI security because service accounts, API keys, workload identities, and AI agents often inherit identity design mistakes made for human users. When teams ignore directed identity and minimal disclosure, they create broad correlatable identifiers, over-shared tokens, and brittle trust relationships that are easy to abuse. That becomes especially dangerous in environments where secrets are stored in code or CI/CD systems, because one leaked credential can reveal too much about how the identity system is structured.
NHI Management Group’s Top 10 NHI Issues highlights how often identity scope and governance fail together, and the 52 NHI Breaches Analysis shows the downstream cost when privileges, rotation, and visibility are not designed with restraint. The concept also connects to the NIST Cybersecurity Framework 2.0 because identity trust must be managed continuously, not assumed from a one-time login event. Organisations typically encounter the relevance of the 7 Laws only after a cross-tenant exposure, token replay incident, or AI agent misuse reveals that identity was over-shared and under-governed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC | Identity design laws support least-privilege access and controlled disclosure across systems. |
| NIST SP 800-63 | Identity assurance guidance informs how strong proofing and federation should be balanced. | |
| NIST Zero Trust (SP 800-207) | AC-4 | Zero trust reinforces context-aware identity decisions and minimal trust assumptions. |
| OWASP Agentic AI Top 10 | LLM-04 | Agentic systems must constrain identity exposure and tool authority to reduce misuse. |
| OWASP Non-Human Identity Top 10 | NHI-02 | Secret handling and identity sprawl risks align with over-disclosure and weak identity governance. |
Design identity flows to disclose only needed attributes and enforce access boundaries continuously.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
