What Is a Non-Human Identity for an AI Agent

A non-human identity for an AI agent is a unique login for the agent itself, not a copy of yours. It has its own identifier, its own credentials, a named owner, a list of what it may touch, a log of what it did, and a way to revoke it without firing a person. If the agent uses your password, you do not have an NHI. You have impersonation.

Kief Studio is two people, me and Brian. We run kief.studio from Shrewsbury, Massachusetts, and we put agents into real workflows, not just demos. The usual failure is a shared yes: five people could have approved the refund, the software used someone's personal login, and after an outage the log still names a human who was at lunch. Put the agent on the org chart the same week you put it in production.

Put the agent on the org chart

Think about a new hire who can reach your inbox and your bank, stays logged in overnight, and will not stop to ask whether the last click was a good idea. You would not hand that person your own password and hope the audit trail sorts itself out. An AI agent that can refund, post, or query production is the same kind of hire, except it never goes home.

A non-human identity is a name in the directory for something that is not a person. A service account, a workload identity, a certificate, and a short-lived token are all NHIs when they name a thing. The agent is one more of those things. At a desk in Shrewsbury, that looks like a row in the password manager labeled "support-draft-bot" instead of a sticky note that says "use Amelia's ChatGPT."

Bill Fisher and Ryan Galluzzo at NIST, on 27 August 2026, wrote that credential sharing with agents creates accountability gaps, especially where you later need to prove who acted. If every line in the log says "Amelia," you cannot prove the agent did the work, and you cannot prove Amelia did not.

Vendor surveys now quote NHI-to-human ratios in the tens to one. Treat those as direction, not your headcount. You do not need the ratio. You need an inventory: every key, bot, and agent that can act. If a vendor cannot issue the agent its own identity, you are renting impersonation. That is one of the questions in what to ask your vendors about security.

Five questions that make the definition usable

Walk these with whoever is about to connect an agent to mail, files, or money. Write the answers down. If a question takes a paragraph, the job is still too big.

1. What is it? Give it a name, a purpose, and an environment. Production is not "also staging." "Help with operations" is a wish. "Draft answers to our five most common support questions and leave them in a folder for a person to publish" is a job.
2. Who owns it? A person on payroll, not "engineering," not "the intern's ChatGPT." When something goes wrong you will want a phone number, not a department name.
3. What may it access? A short list. Not the founder's inbox by default. Not leftover admin from last quarter's experiment. Least privilege is how much access. NHI is who that access belongs to. You need both.
4. What did it do? Logs that say the agent acted, not that Alice did. If the record cannot name the agent, you will investigate a ghost.
5. How do you revoke it? A switch that does not require deleting a human account. Practice turning it off once on a quiet afternoon, before you need to.

Shared credentials feel efficient. They also spread blame until an incident has no author. If five of you can approve a refund, nobody feels like the owner when one goes wrong. Agents make that worse when they share a person's login, because the log still names a human. After an outage you will not know who to call. That is not a scare story. It is how groups fail at boring tasks.

CISA's 1 May 2026 note on agentic services called the same failure out as records that are too vague to use. The allied paper is Five Eyes agentic AI guidance for a small business.

What a non-human identity is not

It is not a second phone prompt on your laptop. Multi-factor authentication is a second check besides the password, like a phone prompt when you open the billing portal. That check still names you. An NHI names the agent.

It is not "we have Okta." A directory product can hold human logins and still have no row for the bot. It is not a long-lived API key sitting in a markdown file that three contractors still have. NIST's same post flags static and long-lived credentials as a pattern that already caused incidents, now scaled by agents. Short-lived, scoped tokens exist today: OAuth, SPIFFE, sender-constrained tokens. You do not wait for a new religion of identity.

Okta's NHI lifecycle explainer is a vendor page, but the lifecycle idea is right: create, review, retire. Humans get an HR offboarding ticket. Agents often do not. That is why keys outlive internships. A shared "deploy" account used by people and bots is not an NHI. It is a group password.

A Monday inventory you can actually finish

You do not need a new identity product to start. You need a list and an afternoon.

1. List every bot, Zapier-style connection, CI token, and chat agent that can change data or send mail.
2. Note whether it uses a person's login. Those are impersonations. Schedule replacements.
3. Assign an owner and an expiry. No owner means it is already orphaned.
4. Turn logging on so the actor field is the agent name.
5. Put the secret in the password manager, not in Slack. I wrote the office version of that habit as why your password manager is the best security investment.

This sits next to where data governance starts. If you cannot say which folder the agent may read, you are not ready to let it write. It also sits next to MCP security for a small business, because the plug that lets an agent call tools is another place a borrowed human login hides.

Leave payroll, the public site, and vendor payments alone until a smaller job is boring. Have it draft an internal FAQ, or summarize last week's tickets for the team. The walkthrough is built to look finished. After ten minutes of that, people hand it a real job. Looking good in a meeting is not the same as being ready to refund a customer's card. So start with work where a mistake is easy to fix. That is the same advice I give when a polished demo makes people skip identity: how to evaluate AI tools without getting sold.

Local agents and borrowed laptops

NIST also flags local agents running as the user's account: convenient for coding, fatal when you later need to prove who typed what. If the agent can open the terminal as you, the log is you. Sandbox it, or give it a separate identity that cannot reach payroll. Consumer tools will keep making the insecure path easy. Your job is to make the named-agent path the default for anything that touches money, patients, or production.

Watch the whole path, not only each click. Five refunds that each look fine can still empty the drawer. A person who has to click "allow" on every tiny step gets tired and clicks through. That is the same fatigue you get from too many phone prompts on a login. I unpacked the path problem in AI agent governance that checks the sequence, not only the click. Identity is who acted. Sequence is what they did in a row.

OWASP's agentic application work from late 2025 put identity and privilege abuse in the top categories. You do not need the full top ten to start. You need "this bot is not me" in the directory. kief.dev is where we publish engineering hygiene. Brian's write-up on briansgagne.com is the deeper IAM architecture when you need it. Kief Studio will not sell you a new identity religion. We will put the agent on the chart the same week we put it in production.

If you want someone else to hold the night shift while those logins exist, that hire is how we describe the work at ltfi.ai. I explained the split in what LTFI is: a department, not a box you install. Either way, the agent still needs its own name.

Related reading

• AI agent governance: sequence, not each click
• MCP security for a small business
• Five Eyes agentic AI guidance for a small business
• How to evaluate AI tools without getting sold
• Data governance where to start
• What LTFI is, and what you do not install

Frequently Asked Questions

Is a service account a non-human identity for an AI agent?

It can be, if it is unique to the agent, owned, scoped, logged, and revocable. A shared "deploy" account used by people and bots is not an NHI. It is a group password.

Why not just share my login with the agent?

Because the record will say you acted. NIST calls that an accountability gap. Refunds, health data, and money need a named actor.

Do I need a new identity product to start?

No. Start with inventory, named owners, and stop using personal passwords in agents. Buy tooling after you know how many NHIs you already have.

How is this different from least privilege?

Least privilege is how much access. NHI is who the access belongs to. You need both. Privilege on a borrowed human identity still impersonates.

What if the agent only runs on my laptop?

If it runs as your account, the log is still you. Give it a separate identity, or keep it away from payroll, patients, and production.