Non-human identity for AI agents
AI agents break identity models because they authenticate like services but behave like users — making unpredictable, context-dependent calls at machine speed. The result is over-scoped credentials and actions nobody can attribute.
Get an Agent Trust Gap BriefWhy the existing model does not fit
Service accounts were designed for predictable workloads: a job that runs at 2am and calls three endpoints. You scope the credential to those endpoints and forget it. An agent calls whichever endpoint its reasoning selects, in an order nobody specified, at a volume nobody predicted.
The practical consequence is over-scoping. Because nobody can enumerate in advance which calls the agent will need, it gets broad access "to be safe" — which is precisely backwards. Broad access plus unpredictable behaviour is the worst combination available.
| Property | Human identity | Traditional service account | AI agent |
|---|---|---|---|
| Call pattern | Unpredictable | Fixed and known | Unpredictable |
| Volume | Low | Known | Machine speed |
| Credential lifetime | Session | Long-lived | Should be short — usually is not |
| Attribution | To a person | To a job | Often to nothing useful |
| Approval model | The person decides | No approvals | Needs per-action approval |
What to do
- Give every agent its own identity. Not a shared service account. If two agents share a credential, neither action is attributable and neither can be revoked independently.
- Short-lived credentials. The expiry becomes your worst-case revocation time — it converts an unknown into a number you can state.
- Scope to actions, not systems. "Can send email to customers in region X" beats "has the SMTP credential".
- Bind the identity to an owner. Every non-human identity needs a human owner, recorded, reviewed when people change roles.
- Time-bounded elevation. When an agent needs more for a backlog, grant it with an expiry. Permanent grants made for temporary reasons are how privilege creep happens.
- Inventory before anything else. Most organisations cannot list their non-human identities. Discovery consistently takes longer than remediation.
The question that finds the gap
Pick any action your agent took last week. Can you name, from records alone, which identity performed it, what that identity was permitted to do at that moment, and who owned it? If any part requires asking an engineer, attribution is not solved. See agent identity.
Common questions
What is non-human identity?
Identity for software rather than people — service accounts, workloads, and now AI agents. It matters more for agents because they make unpredictable calls at machine speed, which is exactly what traditional service-account scoping assumes will not happen.
Should each agent have its own credential?
Yes. Shared credentials make actions unattributable and prevent revoking one agent without breaking others.
How long should agent credentials live?
Short enough that natural expiry is an acceptable worst-case revocation window. That turns a vague assurance into a measurable property.
What is the biggest non-human identity risk with agents?
Over-scoping. Because nobody can predict which calls the agent needs, it is granted broad access, which combines badly with unpredictable behaviour.
How do we start?
Inventory. Enumerate every non-human identity, its scope, its owner and its credential lifetime. You cannot right-size what you have not listed.
Last verified 2026-08-07. Sources are named inline. Not legal advice.
By Julian Joseph, Founder, ApexClaw. Written from direct work operating autonomous systems under governance. Reviewed against the claims policy: sourced, first-party, or labelled.