Background
The identities behind the scenes
A non-human identity (NHI) is any identity that does not belong to a person: the service account running the overnight job, the API key connecting two systems, the certificate behind an integration and the token in a CI/CD pipeline. They appear every time somebody builds, integrates or automates something – and they rarely disappear again.
Where an employee has a manager, a start date and a leaver process, the service account typically has none of these. It was created for a project years ago, the project team has moved on, and today nobody dares switch it off because nobody knows what would stop working.
The risk
Why they are an obvious target
- Broad permissions: service accounts often get more rights than they need, because that was the quickest way to make the integration work.
- No rotation: passwords and keys that are never changed, sitting in scripts, pipelines and shared documents.
- No MFA: machines cannot approve with a phone, so the account is protected by nothing but its password or key.
- No owner: when nobody is responsible, nobody reacts to suspicious activity or cleans up.
- No expiry: employees leave – service accounts keep running until somebody actively shuts them down.
Governance for identities that cannot answer an email
The disciplines are the same as for employees: every non-human identity needs a named owner, a documented purpose and only the access the task requires. Creation should go through a controlled process, and keys and passwords should be rotated automatically – ideally from a central secrets solution rather than living in code.
Recertification catches the rest: at fixed intervals, the owner confirms that the account is still needed and that its access matches actual use. Accounts without an owner or without activity are the first candidates for shutdown.
Where should you start?
With the overview. Most organisations are surprised by how many service accounts, keys and tokens a discovery exercise finds – and how many of them nobody can explain. Map them, assign owners, and close what is no longer used.
If AI agents are entering your environment, the matter is more urgent still: agents are the newest and fastest-growing type of non-human identity, and they inherit every NHI problem in amplified form. The disciplines from our article on governing AI agents are the same ones that need to be in place here.
How many identities do you actually have?
An IAM Healthcheck maps your identities and access – people and machines alike – and gives you a prioritised plan for clean-up and governance.
