What Is a Non-Human Identity (NHI)?

A non-human identity (NHI) is any identity that is not a person: service accounts, API keys, OAuth tokens, certificates, workloads, bots, and increasingly AI agents. In most organizations, NHIs now outnumber human identities many times over, and they are widely under-governed.

Why NHIs are a growing risk

NHIs often have broad, standing privileges, no MFA, and credentials that rarely rotate. Leaked keys and over-permissioned service accounts are a leading cause of cloud breaches. See our secrets sprawl data for the scale of leaked credentials.

The new wave: AI agents

AI agents act on behalf of users, call APIs, and chain tools together. They need identities that are scoped, delegated, auditable, and revocable, which traditional service accounts do not provide. This is the focus of the emerging agentic and AI identity category and protocols like MCP authorization.

How to manage them

Discover every NHI, remove standing privileges, rotate and vault secrets, and govern lifecycle like you would human accounts. Machine and workload identity and PKI tools handle the cryptographic side.

Start with ownership, not discovery

The instinct is to buy a discovery tool, and the result is an inventory of 40,000 identities that nobody acts on. The prerequisite is ownership: an identity with a named human accountable for it can be reviewed, scoped, rotated, and eventually retired. One without an owner cannot be touched, because nobody will accept the risk of breaking it.

A workable sequence:

1. Assign owners to the identities that can reach production or customer data. Unowned means scheduled for removal, and that deadline is what produces owners.
2. Set an expiry on every credential, even if the first expiry is a year out. An identity with no expiry never gets reviewed.
3. Scope down using usage data, which is the only evidence an owner will accept.
4. Replace static credentials with platform-attested workload identity wherever the runtime can vouch for the caller.
5. Put them in access reviews. If your quarterly certification does not list non-human identities, it is certifying a shrinking fraction of what can reach your data.

What AI agents change

Agents are non-human identities created faster than any review cycle, and they break two assumptions: there is no interactive login, and the agent acts for a user across several systems, so the audit question becomes a delegation chain rather than a single call.

The standards moved quickly in 2026. Okta's Cross App Access was adopted as the Enterprise-Managed Authorization extension for the Model Context Protocol, MCP authorization settled on OAuth 2.1 with PKCE, and Microsoft Entra Agent ID reached general availability. That gives agents short-lived, revocable, identity-provider-issued tokens instead of static API keys.

The governance did not move as fast. Okta's own research puts the share of organizations applying human-grade controls to agents at 34 percent. See agent identity just got a protocol and agentic identity.

Where to start

Where to start

For the full picture, read the non-human identity security guide, the deep dive on securing AI agent identities, and the machine identity management guide. When you are choosing tools, see best machine identity for enterprises.