The active status that determines what a person or account should be allowed to do at a given moment. In practice, this includes source of authority, ownership, purpose, and duration, so governance can adjust access when the relationship changes instead of after manual review.
Expanded Definition
Relationship state is the live governance condition that determines what a person, workload, service account, or agent should be allowed to do at a given moment. It is not just whether an identity exists. It captures the current authority to act, who owns the relationship, what purpose it serves, and how long that purpose remains valid.
In NHI operations, relationship state helps security teams treat access as conditional and time bound rather than permanent. That matters because an account can be technically active while the business relationship behind it has already changed. When relationship state is tracked correctly, controls can respond to onboarding, transfers, project completion, vendor exit, or automation retirement without waiting for a manual review cycle. This aligns with the operational emphasis in the NIST Cybersecurity Framework 2.0, where identity governance supports continuous access decision-making.
Definitions vary across vendors on whether relationship state is a formal attribute, a policy result, or a lifecycle event. In practice, it is best understood as the current state that should drive access enforcement across NHI systems, IAM workflows, and agent governance. The most common misapplication is treating relationship state as a static onboarding field, which occurs when teams fail to update authority and purpose after a role, contract, or automation path changes.
Examples and Use Cases
Implementing relationship state rigorously often introduces lifecycle coordination overhead, requiring organisations to balance faster automation against tighter approval, review, and revocation discipline.
- A vendor API key is issued for a support engagement, but its relationship state changes to inactive when the contract ends, triggering revocation instead of renewal by habit.
- An internal service account remains technically valid after a team restructure, yet its ownership and purpose have changed, so access policy must be recalculated before the next deployment.
- An AI agent is granted tool access only while it is assigned to a specific workflow, and that relationship state expires when the workflow is retired or reassigned.
- A platform team uses relationship state to distinguish between “provisioned,” “delegated,” and “decommissioned” accounts so that JIT access is removed when business need ends.
- Security leaders can benchmark relationship-driven remediation against NHI risk data in the Ultimate Guide to NHIs, then compare lifecycle controls with the intent of the NIST Cybersecurity Framework 2.0.
In mature environments, relationship state is also used to drive approvals for privilege escalation, offboarding queues, and periodic attestations. It becomes especially important where ownership changes faster than credential rotation, because the account may still work even after the relationship has become invalid.
Why It Matters in NHI Security
Relationship state is a control point for stopping stale authority from becoming standing privilege. When it is unclear, organisations end up over-trusting accounts that no longer have a valid business need, which increases the chance that secrets, tokens, and agent permissions outlive the relationship that justified them. That is a direct NHI governance failure, not just an IAM admin problem.
NHI Mgmt Group research shows that 97% of NHIs carry excessive privileges, and only 20% have formal processes for offboarding and revoking API keys, with even fewer having rotation procedures, according to the Ultimate Guide to NHIs. Those numbers make relationship state operationally important because access that is not tied to a current relationship is usually over-permissioned by default. This is why the concept matters in zero trust programs and identity governance reviews, including the access and entitlement expectations described in the NIST Cybersecurity Framework 2.0.
Organisations typically encounter relationship state as an urgent issue only after an ex-employee integration, vendor exit, secret leak, or agent misuse exposes that access remained active long after the underlying relationship ended, at which point relationship state becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Relationship state drives whether NHI credentials should remain active or be revoked. |
| NIST CSF 2.0 | PR.AA-01 | Identity and access permissions should reflect current business need and authority. |
| NIST Zero Trust (SP 800-207) | PA/continuous authorization | Zero Trust relies on continuously evaluated trust, which fits relationship-state changes. |
| NIST SP 800-63 | Digital identity assurance depends on binding credentials to valid lifecycle status. | |
| CSA MAESTRO | Agentic workflows require runtime governance of delegated authority and purpose. |
Continuously validate NHI access against the current relationship, not the original provisioning event.
Related resources from NHI Mgmt Group
- Who is accountable when an AI agent exposes credentials or changes identity state?
- How should security teams implement state, nonce, and PKCE together in OIDC flows?
- What breaks when teams rely on system state restore for identity servers?
- Who is accountable for third-party access when a vendor relationship ends?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 11, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
