Non-human identity (NHI)

NHIs vastly outnumber human accounts in most environments and have historically gotten far less governance: no MFA, rare rotation, broad scopes, unclear ownership, and no offboarding. Agents add more of them — each agent, tool integration, and MCP server needs credentials to act.

Why it matters

Agents make the NHI problem worse and more dynamic. An agent's identity may be used to touch many systems in one session, its permissions are often inherited wholesale from a human or a service account, and a prompt injection turns that identity into the attacker's. Scoping agent identities tightly, giving them their own short-lived credentials, and being able to attribute actions to a specific agent are becoming baseline requirements.