Non-human identity
In short: A non-human identity is any account, key, token or certificate used by software rather than a person. Service accounts, API keys and AI agents all count. Non-human identities often outnumber people and are harder to track, because nobody signs in with them each morning.
Which controls use this term?
- GOV-01Agent inventory. Keep a single, current list of every AI agent in use, with its platform, identity, tools and the systems it can reach.
- GOV-05Short-lived credentials. Issue agents credentials that expire within minutes or hours and are scoped to a task, instead of static keys or long-lived tokens.
Which terms are related?
Agent governance, Agent inventory, Shadow agent, Just-in-time access, Short-lived credential, Standing privilege.
Reviewed by The Register desk