What is a non-human identity in AI agent systems?

Any credential an agent uses to act — an API key, service account, OAuth token, workload identity or machine certificate. Agent frameworks create them per agent, per tool and per environment, so a single team shipping ten agents can generate dozens of credentials in a sprint. Rubrik Zero Labs calls the resulting population a shadow workforce because it grows faster than enterprises can track it.

How do I inventory the AI agents running in my environment?

Work from credentials backwards, not from documentation forwards. Enumerate active API keys per model provider, service accounts and workload identities in each cloud, OAuth grants in your identity provider, and outbound calls to model endpoints in egress logs. Any credential you cannot map to a named human owner and a documented purpose is your starting backlog.

What is the single most effective control for agent identities?

Short-lived credentials. Persistent access is the specific property that turns a forgotten agent into a standing attack path, so expiry converts abandonment into automatic decommissioning. It is also self-cleaning: nobody has to run a recertification campaign to remove access that expires on its own.

Should every agent action require human approval?

No — blanket approval is why more than 80% of surveyed leaders report agents costing more oversight than they save. Classify each tool an agent can call as reversible or irreversible, gate only the irreversible ones, and let reversible actions run unattended with logging. Approval is a scarce resource and should be spent where undo does not exist.

Quick Answer

How to Govern Non-Human Agent Identities: 2026 Guide

Published: September 8, 2026

The Problem, Stated Precisely

Rubrik Zero Labs’ September 2026 survey of more than 1,600 IT and security leaders found only 23% report full visibility into the agents operating in their environments — and notes that figure is probably an over-estimate. Meanwhile 86% expect agents to outpace their security guardrails within a year, and 88% cannot roll back agent actions without system disruption.

You cannot govern what you cannot enumerate. This guide is the enumeration-first sequence, ordered so that each step is useful even if you stop there.

Step 1: Enumerate From Credentials, Not Documentation

Do not start with an inventory spreadsheet or a survey of teams. Both capture the agents people remember. Start with credentials, because a credential is a fact your systems can prove.

Pull all four lists:

Source	What to extract
Model provider consoles	Every active API key, last-used date, owner
Cloud IAM	Service accounts, workload identities, roles with no human attached
Identity provider	OAuth grants and app registrations issued to non-human apps
Egress / proxy logs	Every outbound call to a model endpoint, by source

The egress log is the one that finds what you did not know about. Console lists show credentials someone registered properly; egress shows traffic regardless of whether anyone registered anything.

✅ Done when: every credential in the four lists maps to a named human owner and a one-line purpose. Anything unmapped is your backlog, and it will be larger than expected.

Step 2: Kill the Orphans Immediately

Any credential with no owner, or with a last-used date older than 90 days, gets revoked now — not after a review cycle.

This is the highest-value hour in the whole process. Dormant agent credentials with persistent access are the cheapest possible attack path: legitimate, unmonitored, and attributable to nobody.

⚠️ Expect to break something. Revoke in a window where you can restore quickly, and treat each breakage as free discovery — anything that screams was a real dependency nobody documented.

✅ Done when: zero credentials remain with no owner or no use in 90 days.

Step 3: Give Every Agent Its Own Identity

Shared credentials make post-incident attribution impossible. If three agents use one key, an incident tells you something misbehaved and nothing about what.

One agent, one identity, one environment. The dev agent and the prod agent do not share a credential either — that is how a test run reaches production data.

✅ Done when: no credential is used by more than one agent, and dev/staging/prod credentials are distinct.

Step 4: Scope Permissions to the Job, Then Cut Again

Agents inherit whatever you grant, and defaults are generous. Grant the minimum that lets the agent finish its actual task.

Two failure patterns to check for specifically:

Role reuse. Attaching an existing human role to an agent because it exists. Human roles are broad because humans do many jobs; agents do one.
Transitive reach. An agent that calls another agent or a tool inherits the union of what is downstream. Compute effective permissions across the chain, not per credential — this is where the real blast radius hides.

✅ Done when: for each agent you can state, in one sentence, the worst thing it could do with the access it holds. If you cannot, the scope is too wide.

Step 5: Make Credentials Expire by Default

This is the highest-leverage control in the guide. Persistent access is what turns a forgotten agent into a standing attack path. Expiry converts abandonment into automatic decommissioning.

Preference order:

Workload identity federation — no stored secret at all; the platform vouches for the workload.
Short-lived tokens issued per session or per run.
Rotating keys with automated rotation.
Static long-lived keys — only when nothing else is supported, and then with an expiry date recorded and enforced.

The secondary benefit is that expiry is self-cleaning: no recertification campaign, no annual access review theatre, no nagging.

✅ Done when: the default credential lifetime for new agents is measured in hours or days, and long-lived exceptions are individually justified and dated.

Step 6: Gate Only the Irreversible Actions

More than 80% of surveyed leaders say agents require more manual oversight than they save in efficiency. That is what blanket approval produces: the model does the work and a human re-does the checking, so the efficiency gain evaporates.

The fix is to spend approval where undo does not exist. Classify every tool an agent can call:

Action type	Example	Control
Reversible	Read, query, draft, dry-run	Run unattended, log it
Recoverable	DB write with PITR, versioned file edit	Log + alert, no gate
Irreversible	Email sent, payment made, external API with side effects, hard delete	Human approval

Most agent actions are reads. If your gate fires on every step, you have not classified — you have panicked. Classification is a half-day exercise that pays for itself in the first week.

✅ Done when: every tool in every agent’s toolset is labelled, and gates exist only on the irreversible label.

Step 7: Log to Somewhere the Agent Cannot Reach

After an incident you need to answer “what did it touch” without trusting the environment that was compromised.

Log every agent action — identity, tool, arguments, result, timestamp — to an append-only store outside the agent’s own permission scope. If the agent’s credentials can edit the audit log, you do not have an audit log.

Then test recovery. Nearly nine in ten leaders in the Rubrik survey worry about meeting recovery objectives, and 88% cannot roll back cleanly. An untested restore is a hypothesis. Run one bad-agent-run drill: let a non-production agent make a mess, then measure how long detection, scoping and restoration actually take.

✅ Done when: you have completed one drill end-to-end and written down the real numbers.

The Ninety-Day Version

If you can only do part of this:

Week	Do
1	Step 1 (enumerate) and Step 2 (kill orphans)
2–4	Step 3 (unique identities) and Step 6 (classify tools)
5–8	Step 5 (expiry by default) for all new agents
9–12	Step 4 (re-scope) and Step 7 (immutable logging + one drill)

Steps 1, 2 and 5 alone remove most of the standing risk. They are also the least political: nobody defends credentials that belong to nobody and have not been used since spring.

Last verified: September 8, 2026.