Non-Human Identity (NHI)
A non-human identity (NHI) is any digital identity that does not belong to a person. Service accounts, API keys, OAuth tokens, bots, and AI agents all fall under this umbrella. NHIs authenticate to systems and access data programmatically, typically without a human present at the time of access.
Why It Matters
NHIs have existed for decades. Every API key that connects a monitoring tool to a database, every service account that runs a CI/CD pipeline, every bot that posts alerts to Slack is a non-human identity. What has changed is scale and autonomy.
AI agents are a distinct subclass of NHI. Unlike traditional service accounts, agents act on delegated human authority, make non-deterministic decisions, and can chain together multiple system calls in pursuit of a goal. A service account runs the same query the same way every time. An agent decides which query to run based on a prompt.
This distinction matters for governance. Traditional NHI management (rotating API keys, auditing service accounts, revoking stale tokens) does not address the access control, behavioral monitoring, and delegation-chain problems that agents introduce.