Every organisation has a list of employees and a process that governs it. Almost none has an equivalent list of the service accounts, integration keys, scheduled jobs and now agents that act inside its systems — even though these outnumber the people by a wide margin and often hold broader permissions.
Why they escaped governance
Machine credentials are usually created in the middle of solving something else. An integration needs to work by Friday, so someone issues a key under their own account and moves on. There is no onboarding ticket, no approver, and no leaver process, because nothing about it looked like hiring a person.
The result is a population of credentials with no owner, no expiry and no review. They accumulate permissions as integrations grow, and they are rarely removed, because nobody is confident what would break.
The three questions that reveal the gap
Pick any non-human credential in your estate and ask: who owns it, what is it allowed to do, and when does it end? In most organisations the first question has an uncertain answer, the second is “whatever its creator could do”, and the third is “never”.
Those are the same three questions identity governance answers for employees. The machinery exists; it was simply never pointed here.
What changes when agents arrive
Agents make this harder in two ways. They are created faster, often by people who are not platform engineers, and they act continuously rather than on a schedule a human reviews. A dormant integration key is a risk; an agent exercising broad permissions all day is a larger one.
They also make it more tractable, because an agent has an obvious human sponsor — the person it acts for. If your model can express that relationship, ownership stops being a spreadsheet exercise.
Treating them as first-class identities
Give every non-human identity an owner, a scope narrower than its creator’s, a network boundary where one applies, and an end date. Make its activity visible in the same audit trail as everything else, and bring it into the same review cycle you already run for people.
None of that requires new concepts. It requires the existing concepts to apply to identities that are not people, which is a platform decision rather than a policy one.
Put it into practice
An inventory worth doing
- Can you list every non-human identity in your estate today?
- Does each one have a named human owner who would be asked at review?
- Are any of them using permissions inherited from a person who has changed role?
- Which of them would keep working if their creator left this week?