Governing Non-Human Identities for AI Agents at Scale

Every AI agent acts through a non-human identity. When an agent calls a model, queries a database, hits an API, or hands work to another agent, it authenticates as some machine identity and presents a secret to do it: a service account, an API key, an OAuth token, a short-lived bearer token, a database credential. The agent is the actor. The non-human identity (NHI) is how it proves it's allowed to act.

As agents spread across the enterprise, their identities spread with them, and faster. A single agent rarely holds a single credential. It holds one for its model provider, another for each tool it calls, another for each data source it reads, and more for the other agents it delegates to. Multiply that by thousands of agents entering through application teams, vendor products, and platform integrations, and the credential count outruns the agent count by an order of magnitude.

The shadow-agent problem has a twin: shadow credentials. An agent you can't see is a governance gap. An identity you can't see, with standing access to production systems and no accountable owner, is unmanaged risk sitting inside your environment. This post covers what an NHI is for an agent, why NHI sprawl is a security and governance surface, how to discover the identities and secrets agents use, and how to govern them at scale.

What a non-human identity is for an agent

An NHI is the machine identity an agent authenticates as, plus the secrets it presents to gain access: service accounts, API keys, OAuth tokens, short-lived tokens, and database credentials. Where a human logs in as themselves, an agent runs as one or more of these identities and carries the permissions attached to each.

Agents fan out identities faster than traditional service accounts because they act across many systems in a single run, and because teams often provision a fresh credential per tool or data source rather than reuse one. The result is that identity sprawl tracks agent sprawl, only steeper. The taxonomy matters less than what comes next: how you find these identities and how you keep them under control once you have thousands of them.

Why NHI sprawl is a security and governance surface

Credentials that no one is watching become the easiest path to damage in an agentic system. Five patterns show up repeatedly.

Standing, over-privileged credentials. Agents get provisioned with broad access "to be safe," so a bot that only needs to read one table ends up with write access to the whole database. Every extra permission widens the blast radius if that identity is misused or compromised.

Hardcoded and leaked secrets. Keys embedded directly in prompts, code, or config can leak through the same traces and logs you rely on for observability. A secret that shows up in a span is a secret that has left your control.

No ownership or lifecycle. An NHI created for a two-week pilot outlives the pilot. Nobody rotates it, nobody revokes it, and it becomes an orphaned credential with live access and no accountable owner.

The traceability gap. When an action happens, an agent updates a record, calls an external API, moves data, you need to tie it back to which agent, which identity, and which secret. Without that link, investigation stalls and audit fails.

Cross-boundary egress. Agents present credentials to external tools and other agents, often over MCP or direct tool calls. Each of those hops is a point where a credential, or the data it unlocks, can leave your environment.

None of these are theoretical. They're the machine-identity version of the risks that make agent security a review gate before anything ships to production.

Discovering the identities and secrets agents use

Finding NHIs is a signal inside the same multilayered discovery approach that finds agents. You don't run a separate program; you extend the one you already use to inventory agents across telemetry, MCP, network, and cloud APIs.

Telemetry is the anchor. Instrument agents so their traces record which identity and which credential they present on every model call, tool invocation, and data access. Once identity is a field in the span, identities surface in the same OpenTelemetry stream you already collect. From those traces, build the map of which agent touches which system under which identity. Layer in secret detection to flag credentials appearing in prompts, spans, or config before they leak.

The output is an inventory that links agent to identity to secret to accessible systems, sitting directly beside your agent inventory. That linkage is what turns a pile of orphaned keys into something you can govern.

Governing NHIs at scale

Discovery tells you what exists. Governance decides what's allowed and enforces it across thousands of identities. This is where most of the work lives, and where five practices carry the load.

Assign an accountable owner to every identity

Every agent identity needs a named owner responsible for its access and behavior. An NHI without an owner is the same red flag as an agent without an owner, no accountability, no one to answer for what it can reach. Tie identity ownership to the same intake-and-triage flow you use to onboard agents: when a new identity is discovered, it gets routed for review, assigned an owner, and classified before it's considered governed. Clear ownership is a core requirement of any workable agent governance model, and it applies to the credentials as much as the agents.

Grant least privilege and classify by reach

Give each identity only the tools, data, and actions its agent actually needs. Then classify identities by what they can reach, so risk tiering happens automatically: an NHI that can only read a public knowledge base is low risk, one that can write to a payments system is not. Scoped access shrinks the blast radius of every credential, and classification tells you where to focus review first.

Prefer short-lived credentials and rotate the rest

Ephemeral tokens beat standing keys. A credential that expires in an hour is a credential that can't be quietly reused for months. Where standing keys are unavoidable, rotate and revoke them on a schedule, and automatically kill orphaned NHIs left behind by dead pilots. Rotation and expiry turn a leaked secret from a standing liability into a short window.

Block secrets before they leave with guardrails

Runtime guardrails catch what provisioning misses. Pre-LLM guardrails can redact or block secrets and sensitive data before an agent's context ever leaves your environment for an external model provider. The same pattern that strips PII and credentials from prompts, covered in the guardrails best practices, keeps API keys and credentials out of the payloads you send to third parties. This is the last line of defense when a secret slips into a prompt despite everything upstream.

Set policy and monitor for anomalous use

Define policy for who and what an identity may access, then monitor against it. Watch for credential use that breaks pattern: an identity suddenly reaching a new system, a privilege spike, a run of calls at odd hours. Treat those the way you treat eval and guardrail failures, with alerts that fire the moment a threshold is crossed so you investigate before the misuse compounds. Monitoring closes the loop between what you granted and what's actually happening.

Where this connects to the rest of your ASG program

NHI governance isn't a separate tool. The identity inventory sits beside the agent inventory as one source of truth, so security, audit, and governance teams see agents and their credentials in the same view. Ownership and risk classification reuse the same model that governs the agents themselves, the discovery-to-governance flow that turns unmanaged agents into managed operations. And the telemetry and guardrails that make NHIs visible and controllable are the same observability and runtime layers that produce a governable agent in the first place, the foundation laid out across the best practices for agent governance. If you've done the work to instrument and govern your agents, most of the work to govern their identities is already in place.

TLDR

• Every agent acts through a non-human identity, and agents multiply credentials and secrets across systems faster than they multiply themselves.
• NHI sprawl is a security and governance surface: over-privileged, hardcoded, orphaned, and untraceable credentials are unmanaged risk.
• Discover identities and secrets as a signal in the same multilayered inventory that finds agents, linking agent to identity to secret to accessible systems.
• Govern at scale with accountable ownership, least privilege, short-lived credentials and rotation, secret-blocking guardrails, and anomaly monitoring.
• The identity inventory belongs beside the agent inventory as one source of truth.

Ready to bring every agent identity in your environment under one governance framework? Book a demo with an AI expert.

‍