Governing Non-Human Identities:
Observability, Accountability, and SoD in the Age of Automation

For decades, identity governance has focused on a single question: which people should have access to which systems? The answer was found by managing human identities—employees, contractors, third parties—through role definitions, access certifications, and separation of duties policies.

That question remains important. But it is no longer sufficient.

In most enterprise environments today, non-human identities—service accounts, API keys, robotic process automation (RPA) bots, scheduled jobs, microservices, and increasingly AI agents—now outnumber human identities by a significant margin. These actors log in, query databases, transfer data, execute transactions, and make decisions, often continuously and at scale. Yet they are routinely excluded from the governance frameworks that apply to their human counterparts.

This is not a minor oversight. It is a structural gap in how organizations understand and manage risk.

The Chain of Responsibility Problem

Non-human identities do not act autonomously in a vacuum. They are created by someone, configured by someone, assigned permissions by someone, and—when things go wrong—they are the responsibility of someone. The challenge is that this chain of human accountability is rarely documented, and almost never enforced through the same governance mechanisms used for human access.

Consider a service account created three years ago by a developer who has since left the organization. The account still runs a nightly job that reads from a sensitive financial database and writes results to a shared folder. Who owns it? Who certified its permissions last quarter? Who would notice if it started reading data it was never supposed to touch?

In most organizations, the honest answer to all three questions is: nobody knows.

Effective non-human identity governance requires making this chain visible. Every NHI must have a designated human owner—an accountable individual who can certify its permissions, attest to its purpose, and be notified when its behavior deviates from what was originally intended. Without this link, governance is theoretical. With it, accountability becomes real and auditable.

Why Observability Matters More for NHI Than for Humans

Human identities are bounded by working hours, physical location, and the cognitive limits of a single person. A human user can access dozens of resources in a day. A non-human identity can access millions.

This scale difference makes behavioral observability not just useful but essential for NHI governance. A human reviewer can recall whether they approved a transaction; a service account processing ten thousand transactions per hour leaves no such trail unless the governance platform explicitly captures it.

Detekti's identity observability layer applies the same continuous monitoring principles to NHI as to human identities. Every access event, every transaction, every permission use is recorded, correlated, and surfaced in a behavioral timeline. When an API key begins accessing a resource it has never touched before, or when an RPA bot executes a sequence of operations that mirrors a known fraud pattern, the governance platform can detect the deviation and alert the designated owner—before the damage is done.

This is observability in practice: not just logging what happened, but understanding whether what happened was expected, authorized, and consistent with the identity's defined purpose.

Orphaned Agents and Credential Sprawl

Two of the most pervasive risks in non-human identity management are orphaned agents and credential sprawl.

An orphaned agent is an NHI whose human owner no longer exists in the organization—or whose ownership was never formally assigned. These accounts accumulate over time, particularly in organizations that have grown through acquisition, restructuring, or rapid development cycles. They may still hold active credentials with significant permissions, yet no one reviews them during certification cycles because no one claims them.

Credential sprawl occurs when the same NHI uses multiple credentials across different systems, or when credentials are copied, shared, or embedded in code without central tracking. A single microservice may authenticate to a database using one key, to a messaging queue using another, and to an external API using a third—each with different expiry dates, different permission scopes, and different owners, or no owner at all.

Identity timelines in Detekti make both problems visible. When a credential has not been actively used in ninety days but remains valid and permissioned, it appears in the governance dashboard as a candidate for review or revocation. When an NHI's permission scope has expanded over time without a corresponding certification event, the timeline shows exactly when each permission was added, by whom, and whether it was ever formally reviewed.

SoD Matrices for Non-Human Identities

Separation of Duties (SoD) is one of the foundational principles of access governance. The idea is straightforward: no single identity should hold the combination of permissions that would allow it to initiate and approve a transaction, create and authorize a payment, or modify data and audit its own modifications. SoD matrices define which permission combinations are inherently conflicting and must never coexist in a single identity.

This principle has been applied to human identities for decades in regulated industries. It has rarely been applied to non-human identities—and the consequences are significant.

An RPA bot that can both submit a purchase order and approve it for payment is a control failure, regardless of whether a human or a machine holds those permissions. An AI agent that can both read sensitive customer data and write to an external reporting system creates a data governance risk that no human SoD policy would permit. A microservice that can modify configuration settings and disable its own audit logging represents a threat to the integrity of the entire governance framework.

Detekti extends SoD analysis to non-human identities through the same conflict matrix engine used for human access. When an NHI is provisioned or its permissions are modified, the platform evaluates the resulting permission set against defined SoD rules. Conflicts are flagged automatically, reported to the designated human owner, and tracked through the same remediation and certification workflow used for human SoD violations.

The Blast Radius Problem

When a human identity is compromised, the potential damage is real but relatively contained. A single user's credentials, even with elevated privileges, can only be exploited at human speed: one session, one terminal, one workflow at a time.

When a non-human identity is compromised, the damage potential is orders of magnitude larger. A service account with database read permissions and no rate limiting can exfiltrate an entire dataset in minutes. An API key with write access to a messaging system can inject malicious payloads into thousands of downstream processes before anyone notices. An AI agent with decision-making authority over access requests can approve its own privilege escalation without triggering any human review.

This blast radius problem is not hypothetical. Some of the most consequential data breaches in recent years have involved compromised service accounts, exposed API keys, or misconfigured automation credentials—not human user accounts.

Governance platforms that treat NHI as second-class citizens—logging them but not governing them, monitoring them but not certifying them—leave organizations exposed to exactly this class of risk. Detekti's approach is to treat every non-human identity as a first-class governance subject: with an owner, a defined purpose, a permission baseline, behavioral monitoring, and a certification cadence appropriate to its risk profile.

AI Agents: The Next Frontier of NHI Governance

The emergence of AI agents as operational actors in enterprise environments introduces a new dimension to non-human identity governance. Unlike traditional service accounts or RPA bots, which execute deterministic scripts, AI agents make contextual decisions—choosing which data to access, which actions to take, and how to respond to unexpected situations.

This decision-making capacity does not eliminate the need for governance. It intensifies it.

An AI agent that can request access to resources on behalf of a user, approve its own requests through an automated workflow, and then act on those approvals without human review is not a supervised system—it is an ungoverned one. The fact that its decisions are generated by a model rather than typed by a person does not change the accountability question: someone is responsible for what that agent does, and the governance platform must be able to show exactly what it did, when, with what permissions, and under whose authority.

Detekti's identity observability framework captures the full action trail of AI agents alongside their identity context: what access they held, what they used, what they decided, and who owns the responsibility for those decisions. This makes it possible to apply the same evidence-based governance principles to AI agents that have always applied to human identities—accountability, certification, SoD analysis, and behavioral review—regardless of how the underlying decisions are generated.

A Governance Framework Fit for the Full Identity Ecosystem

The organizations best positioned for the next wave of compliance, security, and operational risk requirements are those that have extended their governance frameworks beyond the human perimeter. They know which non-human identities exist in their environment, who owns each one, what it is authorized to do, how it is actually behaving, and when any of that changes.

Building that visibility requires three things: a platform that can ingest and normalize identity data from across the full technology stack; a governance engine that can apply SoD analysis, certification workflows, and risk scoring to non-human identities with the same rigor it applies to humans; and an observability layer that makes NHI behavior continuously visible, auditable, and actionable.

That is exactly what Detekti is designed to deliver—for every identity in your ecosystem, human or not.