Why Non-Human Identity Governance Must Go Beyond Secret Vaulting
Summary
The article argues that growing non-human identities (NHIs), including service accounts, tokens and AI agents, create security and compliance risks when ownership, lifecycle controls and auditability are weak; it recommends governance beyond secret vaulting.
Key points
- Research cited in the article estimates NHI-to-human identity ratios of 45:1 in modern enterprises and 144:1 in cloud-native and DevOps environments.
- The article reports that many NHIs lack ownership or credential rotation, leaving access in place after a creator or project departs.
- A stolen token from a CI/CD log, support export or partner email could enable access across systems while activity remains difficult to attribute, the article warns.
- The article says AI agents can call APIs, spawn sub-agents and acquire permissions dynamically, potentially expanding access beyond anticipated policy scopes.
- It argues that vaulting credentials is only a starting point; governance should also cover identity inventory, accountable ownership, business justification, least privilege, rotation, decommissioning and continuous audit.
Article Details
- Topic
- Governance risks and controls for non-human identities, including service accounts, credentials, and AI agents.