Project · Active · started
Governing Non-Human and Agent Identities
Service accounts, CI/CD runners, API keys and now AI agents outnumber the people in most organisations, and few of them have an owner. A practical governance model built on inventory, human ownership, least privilege and short-lived credentials that works across clouds and SaaS.
Scope
Identity programmes were built around people: joiners, movers, leavers, access reviews. Machine identities skip all of that. They are created by automation, rarely reviewed, often over-privileged and almost never retired. And AI agents are adding a new, faster-growing class on top.
This project builds a governance model that doesn’t depend on any one cloud or vendor:
- Inventory: finding every non-human identity and what it can reach.
- Ownership: tying each one to an accountable human.
- Least privilege: using access data to shrink permissions to what is actually used.
- Credential lifetime: replacing long-lived keys with short-lived, workload-bound credentials.
- Agents: scoping what an agent may do on a user’s behalf, and for how long.
Status
Scoping.
Planned artifacts
- Non-human identity inventory and ownership template
- Least-privilege reduction walkthrough with before/after policies
- Review checklist for granting an AI agent access to a system