Combination context evaluates a request against the full set of access already held by the identity making the request. It matters because a permission that looks reasonable on its own can become risky when combined with other entitlements, creating conflicts of duty, privilege concentration, or hidden escalation paths.
Expanded Definition
Combination context is the practice of evaluating an access request against the full set of entitlements already assigned to the same NHI, service account, or AI agent. It is not just whether one permission is safe in isolation, but whether it becomes dangerous when combined with existing roles, tokens, secrets, or delegation paths.
In NHI governance, this concept sits between entitlement review and effective privilege analysis. A service account may appear low risk until it is paired with write access to a CI/CD pipeline, a vault read permission, and a deployment role. That combination can create a hidden escalation path even when each grant was approved separately. Guidance varies across vendors on how to model combination context, but the security intent is consistent: assess the aggregate power of an identity, not just the latest permission request. This aligns closely with least privilege and the access review expectations reflected in the NIST Cybersecurity Framework 2.0, especially where identity governance must account for cumulative exposure.
The most common misapplication is treating each entitlement as harmless in isolation, which occurs when approvals are reviewed without checking the identity’s existing roles, secrets, and inherited access.
Examples and Use Cases
Implementing combination context rigorously often introduces review overhead, requiring organisations to weigh faster provisioning against the cost of analysing cumulative privilege.
- A build pipeline service account already has repository read access, and a new deploy token would let it push unreviewed code into production.
- An AI agent can call internal tools, and a request to add vault read access becomes more sensitive because the agent can now retrieve credentials and act on them.
- A data-processing NHI has database query rights, and adding export permissions creates a path to bulk extraction that was not visible in either entitlement alone.
- A break-glass style API key appears temporary, but combined with standing admin roles it can bypass intended approval boundaries.
- A security team reviews a service account against the patterns described in the Ultimate Guide to NHIs, then tests whether its current access set already creates excessive privilege concentration.
These scenarios are where combination context matters most: cross-functional access, inherited roles, and machine-to-machine delegation. For implementation guidance, many teams pair entitlement review with identity assurance concepts from the NIST Cybersecurity Framework 2.0 and then validate each NHI against its effective permissions rather than only its assigned roles.
Why It Matters in NHI Security
Combination context is critical because most NHI failures are not caused by one catastrophic permission, but by a stack of individually approved access grants that together create privilege concentration, toxic combinations, or uncontrolled lateral movement. In the NHI landscape, this is especially dangerous because secrets, tokens, and service accounts often outnumber humans and are reused across systems, pipelines, and agents.
NHIMG reports that only 5.7% of organisations have full visibility into their service accounts, which means combination risk is often invisible until a compromise or audit exposes it. The same research shows that 97% of NHIs carry excessive privileges, making cumulative access analysis a practical necessity rather than a theoretical control. When combination context is ignored, organisations can miss the point where apparently routine access turns into an escalation chain.
That is why this concept becomes operationally unavoidable after an incident reveals that a benign account had enough combined access to move from a single system into secrets, deployments, or data stores. Organisations typically encounter the danger only after a breach review or failed audit, at which point combination context is no longer optional.
For broader NHI governance context, see Ultimate Guide to NHIs and the access governance emphasis in the NIST Cybersecurity Framework 2.0.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-06 | Combination context maps to cumulative privilege and toxic entitlement combinations in NHI review. |
| NIST CSF 2.0 | PR.AC-4 | Access permissions management requires reviewing effective access, not isolated grants. |
| NIST SP 800-63 | IAL/AAL | Identity assurance decisions depend on how credentials and access combine across an identity. |
| NIST Zero Trust (SP 800-207) | SC-10 | Zero trust evaluation must consider the full authorization context for each request. |
| OWASP Agentic AI Top 10 | AI-05 | Agent tool access becomes risky when multiple permissions combine into unintended actions. |
Limit agent tool grants so combined capabilities cannot create unauthorized escalation paths.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 24, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
