#1 Authority in NHI Education, Research and Advisory, empowering organizations to tackle the critical risks posed by Non-Human Identities (NHIs), including AI Agents.
Filter by letter or domain, or search to filter the results
An NHI reference glossary for IAM practitioners, architects, and security professionals.
It defines key concepts across non-human identity and agentic AI security, including workload identity, secrets management, and identity governance.
Maintained by the NHI Mgmt Group Editorial Knowledge Base and reviewed by Lalit Choda.
For deeper reading on any topic, visit our Editorial Research Articles in the Knowledge Centre.
Foundations & NHI Taxonomy
Identity Recurrence
Foundations
Identity recurrence is the reappearance of the same actor across multiple accounts, sessions, or access attempts even when primary identifiers change. It is …
Persistent Identifier
Foundations
A durable signal used to recognise a device or browser over time, even when some session attributes change. In practice, it helps teams connect repeated beha…
Remote trust fragmentation
Foundations
A condition where identity assurance is split across devices, email, training, and user attention instead of being enforced in one controlled environment. In…
Shaping
Foundations
Shaping is the stage where a team explores the problem space, tests assumptions, and narrows the solution before building. It is where options are compared, …
Signal volatility
Foundations
Signal volatility is the rate at which a trust indicator becomes less stable, less unique, or less available because of privacy changes, environment changes,…
Tenant-level user isolation
Foundations
A model where the same login identifier maps to separate user records in different tenants. Each tenant gets its own credentials, MFA state, profile, and his…
Trust Tier
Foundations
A trust tier is a level of identity assurance assigned to accounts, users, or integrations based on how strongly they were verified and what they are allowed…
NHI Lifecycle Management
Credential issuance
Lifecycle
The process of creating, enrolling, and binding a credential to a user, device, or account. In mature identity programmes, issuance is a governed control poi…
Help desk identity load
Lifecycle
Help desk identity load is the volume of support effort generated by access problems, especially password resets, lockouts, and account recovery. High load i…
Identity issuance lifecycle
Lifecycle
The identity issuance lifecycle covers how credentials are created, updated, renewed, and revoked over time. For dispersed workforces, it matters because man…
Lifecycle completeness
Lifecycle
Lifecycle completeness means a process reaches a verifiable end state, not just an intended one. In MSP and identity operations, that includes access termina…
Model Deprecation
Lifecycle
Model deprecation is the managed retirement of a model after notice, migration guidance, and replacement planning. In production, it should be treated as a l…
Post-ship Review
Lifecycle
A post-ship review is the period after release when the team watches for issues, usage patterns, and operational friction. It turns launch into a learning lo…
Privileged credential enrollment
Lifecycle
The issuance process for credentials used to access high-risk or elevated accounts. It requires tighter assurance than standard user access because mistakes …
Authentication, Authorisation & Trust
API authorization scope
Auth & Trust
The set of data and actions an API is allowed to access after authentication succeeds. Scope matters because a valid identity alone is not enough to make acc…
Authentication adoption
Auth & Trust
The degree to which a user population consistently completes the intended sign-in or verification flow. In identity programmes, adoption is a security outcom…
Authentication Processing
Auth & Trust
Authentication processing is the set of technical steps used to verify an identity and issue or deny access. In a compliance context, the important question …
Authentication Surface
Auth & Trust
The total set of paths, factors, exceptions, and recovery steps that can be used to prove identity. In a passwordless programme, the surface should shrink, b…
Knowledge factor
Auth & Trust
An authentication factor based on something the user knows, such as a password or PIN. It is convenient, but it remains vulnerable to theft, reuse, coercion,…
Pass-through authentication
Auth & Trust
Pass-through authentication validates cloud sign-ins against an on-premises authentication source rather than storing a reusable password verifier in the clo…
Remote identity authentication
Auth & Trust
Remote identity authentication is the process of verifying a user and device when access happens outside a controlled office environment. It combines credent…
Architecture & Implementation
Connected-to-scope System
Architecture
A connected-to-scope system does not directly handle card data, but it can still affect the security of the payment environment. These systems often include …
Control plane resilience
Architecture
The ability to preserve and restore the management logic that governs how systems are observed, controlled, and operated. It goes beyond uptime and data dura…
Fallback Routing
Architecture
Fallback routing automatically sends requests intended for one model to another model when the original is no longer available. It improves continuity, but i…
Low-Friction Trust
Architecture
Low-friction trust is a design approach that reduces user challenge by inferring legitimacy from contextual signals instead of explicit verification. It can …
Model Alias
Architecture
A model alias is a stable name that points to a changing underlying model. It makes integration easier, but it also means the visible reference may no longer…
Pipeline privilege escalation
Architecture
Pipeline privilege escalation happens when CI/CD or build automation holds access broad enough to move from development into higher-value systems. The issue …
Single-pane dashboard
Architecture
A single-pane dashboard is a unified interface that brings monitoring, workflow, and reporting into one view. For identity-heavy operations, its value depend…
Governance, Ownership & Risk
Account sprawl
Governance
Account sprawl is the accumulation of multiple user accounts across applications, cloud services, and operational tools for the same person. It becomes risky…
Content governance
Governance
The discipline of deciding what information exists, who owns it, how it is versioned, and which audiences can consume it. For AI-enabled environments, it als…
Customized approach
Governance
A customized approach lets an organisation design controls that meet a security objective without using the exact prescriptive method in the standard. In PCI…
Jurisdictional Control Boundary
Governance
A jurisdictional control boundary is the legal and operational line that defines where identity data and identity operations are allowed to exist. It matters…
PCI Scope Drift
Governance
PCI scope drift happens when the documented payment compliance boundary no longer matches the real systems, identities, and workflows that can touch cardhold…
Privileged User Management
Governance
Privileged User Management is the oversight of people who use elevated accounts and the actions they take. It emphasises monitoring, auditing and access revi…
Scope Review
Governance
A scope review is the process of re-checking which systems, people, and services belong inside PCI DSS coverage after a change occurs. For identity teams, it…
Threats, Abuse & Incident Response
Free Trial Abuse
Threats
Free trial abuse is the repeated exploitation of promotional access or onboarding offers without legitimate intent to convert. It usually involves identity r…
High-Activity Device
Threats
A device or browser instance that generates repeated, concentrated, or unusually frequent events across accounts or sessions. In fraud and identity operation…
Post-login drift
Threats
Post-login drift is the shift from apparently legitimate access to risky or unauthorized behaviour after authentication has already succeeded. The initial si…
Premium-rate number abuse
Threats
The misuse of phone numbers that generate revenue when messages are delivered or completed. In identity workflows, this becomes a monetisation path for attac…
Scaled Abuse
Threats
High-volume misuse that is distributed across many requests, accounts, or sessions to avoid simple thresholds. It often looks like normal traffic in isolatio…
Smart Signals
Threats
Smart signals are behavioural and environmental indicators that increase the quality of a fraud or identity risk decision. They do not prove fraud by themsel…
Trust signal collapse
Threats
Trust signal collapse happens when cues that once helped people judge legitimacy, such as voice familiarity or video realism, can no longer be treated as rel…
Agentic AI & Autonomous Identity
AI Enthusiast
Agentic AI
An AI Enthusiast is an enterprise that uses AI across multiple security functions rather than in a single isolated workflow. In this article, the term signal…
AI Traffic
Agentic AI
Machine-generated requests that may come from scripts, automations, or autonomous agents. In identity governance terms, AI traffic is not trusted because it …
Auth Skill Drift
Agentic AI
The tendency for AI-generated identity logic to drift away from the intended pattern when the agent is not anchored to a governed reference. This shows up as…
Autonomous Actor
Agentic AI
An autonomous actor is an identity that can choose actions, select tools, and decide when to execute without a human approval gate. In governance terms, that…
Delegated Instruction
Agentic AI
A task or command passed from one system or agent to another within an execution chain. The security issue is that downstream systems may treat the instructi…
Machine-facing knowledge path
Agentic AI
A curated route through content that is designed for automated consumers such as LLMs, agents, or internal assistants. It reduces noise and ambiguity, but it…
Runtime authority drift
Agentic AI
A failure mode where an actor begins with a narrow, acceptable level of access or intent, then expands its effective authority as the session unfolds. In age…
NHI & Agent in the Broader IAM Ecosystem
Active Directory synchronization
IAM Ecosystem
Active Directory synchronization is the controlled propagation of identity data between an authoritative directory and connected systems. It keeps users, gro…
B2B audience targeting
IAM Ecosystem
The practice of writing for a specific business decision-maker or practitioner group rather than a general audience. In technical content, it shapes tone, de…
Client-ready content
IAM Ecosystem
Security material that a practitioner can reuse, customise, and deliver without heavy rewriting. For MSPs and identity teams, this matters because usable con…
Content distribution
IAM Ecosystem
The set of channels and methods used to ensure a published asset reaches the intended audience. Distribution includes search visibility, internal sharing, an…
Editorial workflow
IAM Ecosystem
The repeatable process of briefing, researching, drafting, reviewing, and revising a piece of content before publication. In specialist domains, this workflo…
Machine-readable documentation
IAM Ecosystem
Documentation structured so software can extract the intended meaning and priority without relying on human navigation cues alone. In AI contexts, this shift…
Service discovery
IAM Ecosystem
The process of identifying what assets, services, and dependencies exist in the environment and keeping that inventory current. It matters for ITSM because e…
No terms match your search.
Clear search
Clear search
Deepen your NHI knowledge with the official certification course.
NHI Foundation Level Course → Browse FAQ → Discussion Forum →