Every enterprise identity program has the same blind spot. Its governance model was built for people, extended to cover machine identities, and is now expected to handle AI agents that reason, act, and generate new credentials on their own. Non-human identities (NHIs) and AI agents look similar on paper. Both authenticate with API keys, tokens, and service accounts, and operate without direct human oversight. But NHIs follow instructions while AI agents make decisions. The controls designed for one will fail to catch what the other actually does.
Key concepts
- Non-human identities (NHIs) and AI agents are distinct identity types that require different governance, controls, and monitoring
- AI agents introduce dynamic, autonomous behavior that traditional NHI security models cannot effectively manage
- AI agents expand the identity attack surface by generating and interacting with new credentials at machine speed
- Effective identity security requires unified visibility and governance across both NHIs and AI agents to reduce risk and prevent unauthorized access
Non-human identities were already out of control before AI agents showed up
Non-human identities (NHIs), including service accounts, API keys, OAuth tokens, and certificates, now vastly outnumber human users in most enterprise environments. They were the fastest-growing and least-governed part of the identity surface before AI agents entered the picture.
NHIs are the connective tissue of modern infrastructure. Every cloud service, SaaS integration, CI/CD pipeline, and automation workflow depends on machine credentials to authenticate and move data between systems. The problem is that governance was rarely part of the design. Developers spin them up to solve an immediate need, grant broad permissions to avoid friction, and move on. New identities get created faster than anyone can catalog them.
The scale most security teams underestimate
The scale alone would be manageable if these identities were well-governed. They aren't. According to Manage Engine’s 2026 Identity Security Outlook, the vast majority of NHIs sit completely outside formal governance programs, with machine-to-human ratios reaching 500:1. The Verizon 2025 DBIR confirmed that credential abuse remains the top initial attack vector, frequently involving compromised API keys, service accounts, or automation credentials. When NHIs carry broad privileges, and no one verifies whether they are still in use, each one becomes a standing invitation for lateral movement.
The OWASP Non-Human Identities Top 10 codified these risks into a framework that security teams can prioritize against. Saviynt published a detailed breakdown of how they map to a broader identity security program for NHIs. The framework's number-one risk is improper offboarding—NHIs that remain active long after their purpose ends. These orphaned credentials survive employee departures, project cancellations, and infrastructure migrations, retaining access that nobody reviews because nobody remembers they exist.
This was the state of machine identity before AI agents arrived. The foundation was already cracked, and AI agents are building on top of it.
What’s the difference between NHIs and AI agents?
The difference between NHIs and AI agents is behavioral. Non-human identities execute predefined instructions, while AI agents reason and decide which actions to take at runtime. That distinction breaks the assumption identity governance is built on.
Identity governance assumes predictability. Scope the permissions, review them quarterly, revoke when the workload retires. That model works because traditional NHIs do the same thing every time they run. AI agents don't.
AI agents decide at runtime which APIs to call, which data to retrieve, and which tools to use based on their own reasoning. Their access patterns shift depending on context. A single agent might interact with a CRM, a cloud storage service, and an internal database in one workflow, then access an entirely different set of systems in the next.
The OWASP Top 10 for Agentic Applications reinforces this shift. Its third-ranked risk, ASI03 (Identity & Privilege Abuse), covers scenarios where agents inherit, escalate, or share high-privilege credentials without proper scoping. The framework recommends treating agents as managed identities with short-lived, task-scoped credentials and continuous behavioral monitoring.
Why agent autonomy changes the risk model
When a service account is compromised, the damage maps to its permissions. An attacker can do what the account was authorized to do, and security teams can scope the blast radius by reviewing what it had access to.
AI agents break that playbook. A stolen service account credential gives an attacker a key. A compromised agent gives them a key and the ability to figure out which doors are worth opening.
Why treating AI agents like service accounts is dangerous
When organizations treat AI agents in the same way they do service accounts, three risks show up immediately:
- Misapplied controls. Static permission scoping does not account for dynamic behavior. An agent might have appropriate permissions for its primary function but use those same permissions in unintended ways when its reasoning diverges from the original task. Access reviews that check "can this identity reach these systems?" miss the more critical question: "is this identity doing what it was designed to do?"
- Invisible delegation chains. AI agents increasingly interact with other agents through protocols like Google's A2A (agent-to-agent). Each handoff in a multi-agent workflow creates a new access context. If identity is not passed and validated at every step, the audit trail fragments. When something goes wrong, security teams cannot trace the action back to a responsible human owner.
- Compounding audit gaps. Traditional logging captures which identity accessed which resource. When that identity is an agent acting on behalf of a user, spawning sub-agents, and chaining calls across multiple services, the question "who did this?" no longer has a simple answer.
Each of these gaps compounds the others. Static controls miss dynamic behavior, fragmented audit trails hide who's responsible, and logs that can't distinguish agent from owner leave security teams reconstructing after the fact.
Agents create and consume NHIs at machine speed
AI agents don't just use NHIs. They generate them. Every tool connection, every API call, every agent-to-agent (A2A) interaction can produce new tokens, credentials, and sessions. Most of them are short-lived and never inventoried.
A single agent resolving a customer request might spawn an OAuth token to read from Salesforce, a service account session to query a data warehouse, a scoped API key to post to Slack, and a delegated credential to hand the task off to a second agent. All in one workflow. Multiply it across thousands of agents running in parallel, and the identity surface expands faster than any team can catalog.
The Model Context Protocol (MCP), an emerging standard for connecting agents to enterprise tools, accelerates this further. Every tool an agent connects to through MCP is another credential issued, another session opened, another audit gap if nobody's tracking it. Existing governance models were never built to track a surface generated by the systems themselves.
Three questions every security leader should be asking right now
Before evaluating tools or redesigning their identity strategy, security leaders need honest answers to three foundational questions about their current posture. A 2026 Gravitee survey found that only 24.4% of organizations have full visibility into which AI agents are communicating with each other, and more than half of all agents operate without any security oversight or logging. These questions are designed to find out whether your organization is in that majority.
- How many AI agents are operating in your environment right now, and how many does your security team know about?
You cannot secure what you have not inventoried. The agents deployed by IT are only part of the picture. The agents built by development teams, business units, and contractors are the ones most likely to operate without oversight.
- Who owns each agent's access, and what happens to that access when the project or employee is gone?
Ownership is the linchpin of identity lifecycle management. If an agent has no assigned owner, nobody certifies its access, reviews its behavior, or decommissions it when its purpose ends.
- Can you distinguish between a service account doing what it was built for and an AI agent acting outside its intended scope? If monitoring capabilities cannot tell the difference between predictable NHI behavior and unpredictable agent behavior, controls will always be applied too broadly or too narrowly.
The enterprises that scale AI successfully will be the ones that treat identity as the control plane for everything those systems touch—from the agents to the credentials they generate.
Frequently asked questions about NHIs and AI agents
Your next read: You Can’t Secure what you Can’t See - Posture Management for AI Agents
-
https://www.csoonline.com/article/4125156/why-non-human-identities-are-your-biggest-security-blind-spot-in-2026.html
-
https://www.verizon.com/business/resources/reports/dbir/
-
https://owasp.org/www-project-non-human-identities-top-10/2025/
-
https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
-
https://www.gravitee.io/hubfs/Downloadable%20Resource/state_of_ai_agent_security_report_pdf_2026.pdf
Back to Blog
.png)
