A review scoping query defines which accounts, roles, or entitlements are included once a trigger fires. It can differ from the detection query that launched the review, which lets teams separate risk detection from certification scope and avoid reviewing the wrong identity surface.
Expanded Definition
A review scoping query is the rule set that determines which NHIs, roles, groups, or entitlements enter a certification or access review after a trigger event. It is distinct from the detection query that identifies risk, alerting, or policy violations. In practice, this separation matters because the review audience should be bounded by governance intent, not by the broader signal that initiated the review.
In NHI programs, scoping queries are used to define the population for periodic attestations, event-driven access reviews, and exception handling. The concept is closely related to access recertification logic in NIST Cybersecurity Framework 2.0, but no single standard governs the exact query pattern yet. Definitions vary across vendors, especially where service accounts, workload identities, and delegated credentials are mixed into one governance workflow. Good scoping keeps the certification task narrow enough to be auditable while still reflecting the true identity surface.
The most common misapplication is reusing the detection query as the review scope, which occurs when teams let every alert condition automatically define the certification population.
Examples and Use Cases
Implementing review scoping queries rigorously often introduces more governance design effort, requiring organisations to weigh precision in review populations against the convenience of a single shared query.
- A service-account review includes only identities with production write access, while the detection query may have flagged a broader set of risky secrets. That distinction helps avoid certifying low-impact accounts that never touched production.
- An entitlement review targets only privilege-bearing roles assigned in the last 30 days, using the trigger from an unusual login event but narrowing the scope to recent high-risk changes.
- A workload identity campaign includes only non-human identities used in CI/CD pipelines, informed by lifecycle and visibility issues highlighted in the Ultimate Guide to NHIs.
- A third-party access review scopes in only externally exposed secrets and API keys, then uses NIST Cybersecurity Framework 2.0 concepts to align the review with access governance and response workflows.
- An emergency certification excludes break-glass accounts unless the trigger specifically indicates their use, preventing false scope inflation during incident response.
These use cases show that the scoping query is not the alert itself, but the governance lens applied after the alert fires. That makes it especially useful where NHIs outnumber human identities by 25x to 50x and teams cannot afford to review everything at once.
Why It Matters in NHI Security
Review scoping queries protect certification programs from becoming noisy, incomplete, or manipulable. If the scope is too broad, reviewers ignore material risk because the process becomes unmanageable. If the scope is too narrow, high-risk NHIs remain outside governance and can retain excessive access unnoticed. NHI Management Group research shows that 97% of NHIs carry excessive privileges, which makes careful scoping essential for separating true remediation targets from irrelevant identity records in the review queue.
This matters most in environments with weak visibility, where only 5.7% of organisations have full visibility into their service accounts and 79% have experienced secrets leaks. In those conditions, scoping errors can hide the very identities that need review most. The control challenge is not just finding a risky account, but proving that the review population accurately represents the asset or privilege class under governance. That is why scoping should be explicit, documented, and testable against the trigger logic and the identity inventory. Organisations typically encounter the cost of bad scoping only after a failed attestation or post-incident audit, at which point review scoping queries become operationally unavoidable to correct.
For background on the identity risk landscape, see Ultimate Guide to NHIs.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 | Review scope should prevent excessive or irrelevant NHI access from entering certification. |
| NIST CSF 2.0 | PR.AA | Access assessment and authorization depend on correct scoping of identities and entitlements. |
| NIST Zero Trust (SP 800-207) | PA | Policy-driven access decisions require explicit subject and resource scoping. |
| NIST SP 800-63 | IAL2 | Identity evidence quality affects which accounts should be included in governance reviews. |
| OWASP Agentic AI Top 10 | AI-03 | Agentic workflows need bounded review scope to avoid over- or under-certifying tool access. |
Constrain agent and tool reviews to the exact delegated permissions implicated by the trigger.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 25, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
