Episode 211 - GluuFederation/identerati-office-hours GitHub Wiki

Title: NHI Is the Dress Rehearsal for AI Agents

Channels

Description

Every identity team is racing toward AI agents, but most can't yet answer a simpler question: can they see and govern the non-human identities they already have? Service accounts, tokens, and workload identities already outnumber humans by as much as 100 to 1, and most sit ungoverned, unowned, and unmeasured. This episode argues that non-human identity is the dress rehearsal for agent identity — the discovery, ownership, least-privilege, and lifecycle problems agents will force on us are the same ones NHIs have exposed for years, only harder, because an agent's behavior is non-deterministic and its footprint is often ephemeral. The through-line: if you can't govern a service account today, you won't govern an agent tomorrow.

Homework

  • Cloud Security Alliance — The Non-Human Identity Governance Vacuum (May 2026) A vendor-neutral research anchor. The CSA makes the case that non-human identity governance is the defining security gap of the agentic-AI era, noting that NHIs already outnumber human users by roughly 45 to 1 on average — and far more in cloud-native environments. It identifies the absence of clear ownership as the most fundamental gap: unlike a human anchored to an HR record and an offboarding workflow, a service account or agent credential is created ad hoc and routinely outlives the project that justified it, leaving orphaned, unaccountable identities that persist indefinitely.

  • CSO Online — Agentic AI Identity: A 6-Stage Maturity Model for Non-Human Identities (2026) The framework piece, and it maps almost exactly onto this episode's thesis. It offers a staged maturity model and argues that an organization scoring high on human-identity governance but low on agent governance does not have a mature identity practice — the maturity-model version of “you skipped a step.” It also grounds the discussion in analyst signal, citing Gartner's naming of agentic-AI oversight and IAM adaptation to AI agents among the forces redefining cyber risk this year, and sets a floor of minimum controls that must exist before any production agent deployment is defensible.

  • Cyber Security Tribe — The Non-Human Identity Risk Behind AI Agents (June 2026) The practitioner voice, drawn from the OWASP agentic-security work. It draws the exact NHI-versus-agent-identity distinction the episode hinges on, arguing that conflating the two is a core reason most identity programs are not ready for agents. It captures the shift plainly: the old NHI was a static service account doing the same job at 2am — predictable and containable — while an agent reasons, adapts, discovers tools at runtime, and can spawn other agents, making it a dynamic, autonomous identity that most teams are still governing as if it were that 2015-era service account.

Takeaways

  • ⚡ There are four types of agents: (1) task-bound utility agents, (2) autonomous agents, (3) unsanctioned “shadow AI”, and (4) AI features embedded inside SaaS platforms.

  • ⚡ Reasoning is non-deterministic, but execution is finite. Downstream agent gateway, MCP tools, and enterprise assets—are still deterministic and usually rely on traditional non-human identities and credentials.

  • ⚡ Robert asserts that an NHI inventory is a prerequisite for agent governance. His central argument was that organizations must inventory, classify, and remediate both non-human identities and their entitlements before deploying agents at scale. Otherwise, they cannot reliably revoke credentials, certify access, or understand the potential blast radius.

  • ⚡ Mike asserts that for authz, all we need are attestations and assertions from trusted issuers, and policies about what capabilities they unlock. All the related identities--human, software, organizational--are needed for accountability if something goes wrong.

  • ⚡ Agent authorization requires more than identifying the principal. Robert argued that an agent gateway should evaluate intent, business scope, risk, identity relationships, entitlements, and domain-specific transaction rules—then issue a narrowly scoped, ephemeral token for execution. Sort of like the OAuth Transaction Token Draft, see: https://gluu.co/trat

Livestream Archive