On-behalf-of identity is the pattern where one actor performs an action for another actor while both identities remain visible to downstream systems. In agent governance, it lets organisations preserve the human principal, the executing agent, and the scope of authority in the same control and audit model.
Expanded Definition
On-behalf-of identity is an authorisation pattern used when an agent, automation, or service acts for a human principal while preserving both identities in the request path, logs, and policy decisions. In NHI governance, the pattern helps distinguish who initiated an action from what executed it, which is essential when autonomous workflows chain across systems. Definitions vary across vendors, but the core idea is consistent: downstream systems should receive enough identity context to enforce scope, accountability, and revocation without collapsing the actor and the delegate into one ambiguous account. This is especially relevant in Zero Trust and agentic AI environments, where execution authority must be explicit and bounded, as reflected in the NIST Cybersecurity Framework 2.0 and the broader identity guidance discussed in the Ultimate Guide to NHIs. The most common misapplication is treating on-behalf-of identity as a shared service account, which occurs when teams remove the human principal from audit trails and grant the agent broad standing access.
Examples and Use Cases
Implementing on-behalf-of identity rigorously often introduces extra token exchange, policy evaluation, and log correlation overhead, requiring organisations to weigh traceability against integration complexity.
- A customer support AI drafts a refund request, but the downstream finance API records the human approver, the agent executor, and the permitted transaction scope.
- A developer tool calls a deployment pipeline on behalf of an engineer, while policy checks limit the action to a specific repository and environment.
- An incident-response agent retrieves logs for a security analyst, preserving analyst identity in audit records while the agent’s own credentials remain separately bounded.
- A workflow platform requests temporary cloud access on behalf of a user, with short-lived delegation and explicit revocation tied to the original principal.
This pattern is easier to design correctly when teams compare it to real breach paths and credential exposure patterns documented in the 52 NHI Breaches Analysis and the NIST Cybersecurity Framework 2.0, which both reinforce the need for clear identity provenance and access control. It also aligns with practical identity federation approaches such as NIST Cybersecurity Framework 2.0 guidance on governance and access oversight, even where the exact implementation model differs across platforms.
Why It Matters in NHI Security
On-behalf-of identity matters because it prevents delegated automation from becoming invisible automation. When organisations cannot separate the initiator from the executor, they lose the ability to revoke access cleanly, investigate abuse, or prove whether a sensitive action was authorised. NHIMG research shows that 97% of NHIs carry excessive privileges, and only 5.7% of organisations have full visibility into their service accounts, which makes identity lineage even more important than simple authentication strength. The Top 10 NHI Issues article reinforces that poor visibility, privilege sprawl, and weak lifecycle controls are recurring failure modes. For NHI security teams, the practical goal is to ensure delegation is time-bound, auditable, and policy-constrained so that a human can be held accountable without forcing a shared secret or generic service identity to carry the burden. Organisations typically encounter the need for on-behalf-of controls only after a delegated agent performs an unreviewed action, at which point the delegation chain becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Delegated execution increases identity ambiguity and weakens non-human identity governance. |
| NIST CSF 2.0 | PR.AC-4 | Least-privilege access must follow the true principal, not just the executing agent. |
| NIST Zero Trust (SP 800-207) | SA-1 | Zero Trust requires continuous verification of identity context for each delegated action. |
| NIST SP 800-63 | AAL2 | Assurance strength influences whether delegated identity can safely represent a human principal. |
| CSA MAESTRO | IAG-02 | Agent governance requires explicit delegation boundaries and traceable execution context. |
Validate each on-behalf-of transaction with contextual policy before granting execution.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 14, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
