Employee-mediated access

Expanded Definition

Employee-mediated access refers to a control path where a human employee can approve, connect, or unlock access for another person, system, or agent. In NHI and IAM contexts, the term matters because the human is not the asset, but the decision point that can authorize access to secrets, service accounts, or operational tools.

This pattern is common in help desk resets, break-glass approvals, delegated onboarding, and “someone on the team can approve it” workflows. The security challenge is that the approval step often becomes a soft boundary: once an attacker convinces the employee, downstream controls may be bypassed even when the underlying identity stack is strong. Guidance varies across vendors on how much delegation is acceptable, but zero trust designs treat every approval path as a high-risk transaction that must be verified, logged, and bounded.

That distinction is important in relation to controls described in the OWASP Non-Human Identity Top 10, because the weakness is usually not the service account itself but the human-mediated process that grants it power. The most common misapplication is treating an employee’s familiarity with the requestor as sufficient proof, which occurs when approval workflows rely on informal recognition instead of policy-backed verification.

Examples and Use Cases

Implementing employee-mediated access rigorously often introduces friction, requiring organisations to weigh speed of support against the cost of stronger verification and auditability.

• A support engineer approves a temporary unlock for an admin console after verifying a ticket, identity proofing step, and time-bound approval recorded in the workflow.
• A team lead authorises a contractor’s access to a shared repository, but the request is constrained to least privilege and expires automatically after the task window.
• An incident responder receives emergency approval to retrieve a rotating secret during an outage, with the access path reviewed later as part of post-incident governance.
• An employee validates a service account recovery request for a production system, but the actual release is gated by dual approval and step-up authentication.
• A help desk uses a scripted reset process instead of ad hoc judgment, reducing the chance that social engineering turns an ordinary request into a privilege escalation path.

These workflows map closely to patterns described in the Ultimate Guide to NHIs, especially where approvals affect credentials or delegated access. They also align with the NIST SP 800-53 Rev 5 Security and Privacy Controls expectation that access control decisions be enforced through defined authorization mechanisms rather than informal discretion.

Why It Matters in NHI Security

Employee-mediated access becomes a direct NHI risk when the employee is used as a trust amplifier for secrets, tokens, certificates, or service account permissions. A single persuasive request can unlock a chain of access that bypasses rotation, approval separation, and least-privilege checks. That is why the issue belongs in NHI governance, not only in service desk training.

NHIMG research shows that 79% of organisations have experienced secrets leaks, and 77% of those incidents caused tangible damage, which illustrates how one weak approval path can turn into a breach with operational impact. In practice, this is where human convenience and machine privilege collide: once a social engineering attempt succeeds, the attacker may inherit not just a credential, but a workflow that normalises future access. The 52 NHI Breaches Analysis and the Ultimate Guide to NHIs - Key Challenges and Risks both reinforce that delegated trust is often where compromise becomes durable. Organisational controls should therefore log who approved what, require step-up verification for high-risk requests, and limit the scope and duration of any employee-granted access. Organisations typically encounter this problem only after a reset request, impersonation, or emergency unlock is abused, at which point employee-mediated access becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• How should organisations govern non-human identities alongside employee access?
• Why does vendor access usually cost more to secure than employee access?
• What breaks when an AI agent inherits over-provisioned employee access?
• How should security teams compare 2FA and MFA for employee access?