# What Is a Non-Human Identity (NHI)?

Source: https://startwithidentity.com/guides/fundamentals/what-is-non-human-identity/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

A non-human identity (NHI) is any identity that is not a person: service accounts, API keys, OAuth tokens, certificates, workloads, bots, and increasingly **AI agents**. In most organizations, NHIs now outnumber human identities many times over, and they are widely under-governed.

## Why NHIs are a growing risk

NHIs often have **broad, standing privileges**, no MFA, and credentials that rarely rotate. Leaked keys and over-permissioned service accounts are a leading cause of cloud breaches. See our [secrets sprawl data](https://startwithidentity.com/research/) for the scale of leaked credentials.

## The new wave: AI agents

AI agents act on behalf of users, call APIs, and chain tools together. They need identities that are **scoped, delegated, auditable, and revocable**, which traditional service accounts do not provide. This is the focus of the emerging [agentic and AI identity](https://startwithidentity.com/vendors/ai-identity/) category and protocols like MCP authorization.

## How to manage them

Discover every NHI, remove standing privileges, rotate and vault [secrets](https://startwithidentity.com/vendors/secrets/), and govern lifecycle like you would human accounts. [Machine and workload identity](https://startwithidentity.com/vendors/machine-identity/) and [PKI](https://startwithidentity.com/vendors/pki/) tools handle the cryptographic side.

## Start with ownership, not discovery

The instinct is to buy a discovery tool, and the result is an inventory of 40,000 identities that nobody acts on. The prerequisite is ownership: an identity with a named human accountable for it can be reviewed, scoped, rotated, and eventually retired. One without an owner cannot be touched, because nobody will accept the risk of breaking it.

A workable sequence:

1. **Assign owners** to the identities that can reach production or customer data. Unowned means scheduled for removal, and that deadline is what produces owners.
2. **Set an expiry** on every credential, even if the first expiry is a year out. An identity with no expiry never gets reviewed.
3. **Scope down using usage data**, which is the only evidence an owner will accept.
4. **Replace static credentials** with platform-attested [workload identity](https://startwithidentity.com/glossary/workload-identity/) wherever the runtime can vouch for the caller.
5. **Put them in access reviews.** If your quarterly certification does not list non-human identities, it is certifying a shrinking fraction of what can reach your data.

## What AI agents change

Agents are non-human identities created faster than any review cycle, and they break two assumptions: there is no interactive login, and the agent acts for a user across several systems, so the audit question becomes a delegation chain rather than a single call.

The standards moved quickly in 2026. Okta's Cross App Access was adopted as the Enterprise-Managed Authorization extension for the Model Context Protocol, MCP authorization settled on OAuth 2.1 with PKCE, and Microsoft Entra Agent ID reached general availability. That gives agents short-lived, revocable, identity-provider-issued tokens instead of static API keys.

The governance did not move as fast. Okta's own research puts the share of organizations applying human-grade controls to agents at 34 percent. See [agent identity just got a protocol](https://startwithidentity.com/blog/agent-identity-gets-a-protocol/) and [agentic identity](https://startwithidentity.com/glossary/agentic-identity/).

## Where to start

For the full picture, read the [non-human identity security guide](https://startwithidentity.com/guides/machine-identity/non-human-identity-security/), the deep dive on [securing AI agent identities](https://startwithidentity.com/guides/machine-identity/securing-ai-agent-identities/), and the [machine identity management guide](https://startwithidentity.com/guides/machine-identity/machine-identity-management-guide/). When you are choosing tools, see [best machine identity for enterprises](https://startwithidentity.com/rankings/best-machine-identity-for-enterprises/).