- 01Across our customer base the NHI:human ratio is 20:1 to 80:1. Service accounts, CI/CD tokens, OAuth clients, embedded API keys, AI agent identities — issued at convenience, rarely rotated, frequently un-owned.
- 02Minimum NHI program: complete inventory with named owner and business purpose, max credential lifetime (90 days as a starting bar), automated (not human) rotation, centralized issuance via a vault or workload identity provider, off-boarding tied to system retirement.
- 03Replace static credentials with workload identity wherever possible — IRSA, GCP Workload Identity, Azure Managed Identities, SPIFFE in Kubernetes. Cryptographically attested identity eliminates embedded secrets entirely.
- 04AI agents are the next NHI wave: delegated, scoped, often short-lived. Your IdP and authorization stack should already be modeling these — if not, that work belongs on the next-quarter roadmap.
Across our customer base, the ratio of non-human identities (NHI) to human identities ranges from 20:1 to 80:1. Service accounts, CI/CD tokens, OAuth clients, embedded API keys, AI agent identities. In most environments these are issued at convenience, rarely rotated, and frequently un-owned.
The minimum NHI program
- 01An inventory of every NHI, with named owner and business purpose
- 02A maximum credential lifetime (90 days is a reasonable starting bar)
- 03Automated rotation, not human-driven rotation
- 04Centralized issuance via a vault or workload identity provider
- 05Off-boarding tied to system retirement
Workload identity as the modern path
Replace static credentials with workload identity wherever possible. Cloud-native workload identity (AWS IAM Roles for Service Accounts, GCP Workload Identity, Azure Managed Identities, SPIFFE in Kubernetes) eliminates the need for embedded secrets and gives you cryptographically attested identity.
AI agents are the next wave
AI agents acting on behalf of users introduce a new identity class: delegated, scoped, often short-lived. Your IdP and authorization stack should already be modeling these — if it is not, that work belongs on the next-quarter roadmap.