Granular control of non-human identities (NHI)

Static long-lived credentials with broad scope, no ownership attribution, no behavioural baseline, and no offboarding path when the original workload retires. NHIs often hold admin-equivalent permissions because rotation is harder than scope reduction. Cross-cloud roles and OAuth grants between SaaS apps create privilege chains nobody mapped. Most breaches involving NHIs trace back to a credential nobody knew existed.

Calculate effective permissions from runtime usage, then trim assigned scopes to match. For AI agents, scope per task or per user delegation rather than granting standing access. Issue short-lived tokens through a gateway rather than embedding static keys. Re-evaluate on a continuous cadence, since AI agent workflows evolve faster than human roles. Static scoping at provisioning time guarantees drift within weeks.

Hardcoded credentials in source repositories and config files, shared passwords across multiple services, no rotation policy, missing ownership records, over-broad cloud roles, and unused accounts left active for years. OAuth grants made by individual developers for one-off integrations are a particular blind spot. Once compromised, service accounts rarely trigger MFA or behavioural alerts the way human accounts do.

Tie every service account to a human or team owner at creation, with mandatory metadata (purpose, source system, expected scope). Continuous discovery catches accounts created outside the workflow. Usage-based right-sizing trims scope over time. Auto-deactivate accounts with no activity past a threshold. Revocation on owner departure or workload retirement should be automatic, with the source system as the action target.

Store secrets in a managed vault rather than config files. Issue short-lived credentials through workload identity where the cloud or platform supports it. For static secrets that cannot be replaced, schedule rotation against the consuming system's tolerance and verify the new value works before retiring the old. AI agent credentials benefit most from gateway-brokered issuance, which removes rotation as a manual task

SOC 2, ISO 27001, PCI DSS, and HIPAA all require access control, accountability, and audit trails that apply equally to NHIs. Specific requirements include ownership records, periodic access reviews, credential rotation, and revocation evidence. Regulators increasingly expect AI agent governance under the same controls. Most audit findings against NHIs cite missing ownership and stale credentials, both of which automation resolves.

NHIs typically outnumber human identities by a wide margin, often hold higher privilege, and rarely get reviewed. Sprawl expands the attack surface in three ways: more credentials to steal, more orphaned accounts with no owner, and more privilege chains to map. Detection coverage drops because behavioural analytics are tuned for human patterns. The posture impact is rarely visible until an incident makes it concrete.