What is a non-human identity?
A non-human identity is a digital identity assigned to software or services rather than a person, such as a service account, API key, OAuth app, certificate or AI agent.
- A non-human identity is any identity a machine authenticates with: a service account, an API key, an OAuth app, a workload identity or an AI agent.
- Non-human identities outnumber staff accounts in most environments, and unlike staff accounts they have no joiner, mover, leaver process.
- The risk is reach, not count. What matters is which sensitive data an identity can get to, directly or through a role it can assume.
- An AI agent is a non-human identity that chooses its own actions. Everything true of a service account is true of an agent, plus the agent decides what to do with the access.
Published Last reviewed
In practice
Non-human identities authenticate machines to other machines. They often have no MFA, no owner and no expiry, and they outnumber human accounts in most environments. AI agents add a new kind: identities that decide their next action on their own.
Our non-human identity security guide covers the risks and controls in detail.
A non-human identity is a digital identity assigned to software or services rather than a person, such as a service account, API key, OAuth app, certificate or AI agent.
Five kinds, one problem.
The types differ in how they are created and how long they live. They do not differ in what makes them risky, which is the access behind them.
| Type | What it is | Typical lifetime | Who owns it |
|---|---|---|---|
| Service account | An account created for a system rather than a person, often with a role attached. | Years | Frequently nobody |
| API key | A static string that grants access to an API, usually with no expiry. | Until someone rotates it | The team that created it |
| OAuth app grant | Standing delegated access to a user account, granted once by an employee. | Until revoked | The employee who approved it |
| Workload identity | A short-lived credential issued to a running workload by the platform. | Minutes to hours | The platform team |
| AI agent | A workload that decides its own next call, using any of the credentials above. | As long as its credentials | Often unclear |
Why they are harder to govern than people.
Every control that works on staff accounts assumes a person at the other end. Four of those assumptions do not hold here.
A person is hired, changes team and leaves, and an identity process follows each step. A service account is created in a ticket, inherits permissions as projects grow, and is never offboarded because nobody left.
Staff passwords rotate and sessions time out. A static API key in a configuration file works until somebody removes it, which means a key copied in 2023 still opens the same door today.
Staff accounts live in one identity provider. Non-human identities live in cloud IAM, in CI secrets, in SaaS admin panels, in local config files and in vaults, so no single list is complete.
When a permission looks too broad on a staff account, you ask the person or their manager. On a service account with no owner, there is no one who can say what it is for, so the safe choice becomes leaving it alone.
What defines an identity. Four parts.
The parts that decide what a non-human identity can actually reach.
Accounts that let software act in cloud platforms and directories.
Static secrets that authenticate scripts, CI jobs and integrations.
Third-party applications acting on a user’s behalf within scopes.
A new kind of NHI that decides its own next action.
What it looks like in Elmoz
A real path shape, drawn the way the Elmoz security graph shows it.
Questions, answered.
Short answers on non-human identities and how they differ from staff accounts.
What are examples of non-human identities?
Service accounts, API keys, access tokens, OAuth apps, certificates, workload identities and AI agents.
Why are non-human identities risky?
They often have no MFA, no clear owner and no expiry, and their credentials end up in code, CI and config files. Many of them hold broad access that nobody reviews.
Are AI agents non-human identities?
Yes. An AI agent authenticates with credentials like any other NHI, but it also decides which actions to take, which makes its reach more important than its permission list.
How many non-human identities does an organisation have?
Published counts vary widely because every vendor counts different things, so treat any single ratio with care. What is consistent across reports is the direction: machine identities outnumber staff accounts, and the gap grows when agents arrive. A count from your own environment is more useful than any industry ratio.
Keep reading.
The pages that belong to the same picture.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.