Non-human identity governance: what it covers, and where it stops

Non-human identity governance is the discipline of discovering, inventorying, assigning ownership to, and reviewing the identities that are not people: service accounts, API keys, certificates, secrets, workload identities, and increasingly AI agents. It grew out of the recognition that these identities outnumber humans in most enterprises by a wide margin, are rarely reviewed, and hold standing access that nobody is watching.

This is a real problem and the work is worth doing. We want to be fair about that before making the argument that follows.

What NHI governance does

A mature NHI program can tell you which non-human identities exist, where their credentials live, what those credentials can reach, who created them, whether they are still in use, and whether they have been rotated. It can assign an owner to each one, flag the orphaned ones, and put the rest on a review cycle. For the service account and secret sprawl that most organizations have accumulated, this is exactly the right response.

The market has developed quickly, and several NHI vendors were acquired by larger identity and security companies in 2026. That reflects how real the problem is.

Why it was enough for service accounts

A service account executes fixed instructions, the same way, every time. If you know who owns it and what it can reach, you know most of what matters. The authority question is answered by the code: the backup job backs up, and that is all it does. Governing the identity was, in effect, governing the behavior.

Why it is not enough for agents

Agents break that equivalence. An agent is given a goal and chooses its actions. Knowing who owns it and what it can reach tells you the ceiling of what it might do. It tells you nothing about what it was supposed to do, how much, how often, or where a person should step in.

Run any NHI product against your environment and you will get, at best, the following about an agent: that it exists, what it runs on, which credentials it holds, what scopes those credentials carry, sometimes who created it, sometimes what it has been calling. That is a complete description of the problem as it was understood before agents.

Here is what it cannot tell you. What is this agent allowed to decide? On whose authority? What is the limit of that authority across everything it does today? What happens when it reaches that limit? And when it decides wrongly, who answers? None of those are about identity. All of them are about authority. The NHI data model does not have a field for any of them, because it is answering a different question.

The owner field, again

The NHI response to agents has generally been to extend the model: find the agent, assign it an owner, put it on a review cycle. Our position is that this fails in three ways.

An owner is a label, not a control. It names who to call afterward. It does not change what the agent does beforehand.

It does not scale to agents. Ownership and certification campaigns for human access became a quarterly rubber stamp, and everyone in the industry knows it. Agents are more numerous, shorter-lived, and less understood. The same process will not produce a different result.

It only reaches the agents that were found. An identity governance program governs the identities it has inventoried. The agent spun up mid-workflow by another agent, the one running on a borrowed key, the one a team stood up last week without telling anyone: none of them are in the inventory, so none have an owner, and none are governed. Governance that depends on registration is governance of the agents that were going to behave anyway.

Necessary, not sufficient

NHI governance is the floor. It gives every agent that can be found a clean identity, sized access, and a name. Authority governance sits above it: human-owned policy defining what each class of decision permits, enforcement in the action path that evaluates every action regardless of whether the actor was inventoried, and a record of each decision. The first without the second is well-identified agents making decisions nobody authorized. The second without the first has no clean actor to attach to. Both are needed, and they are different products.

Where BotAris fits

BotAris is not an NHI governance tool. It does not discover non-human identities across your estate or manage their credentials. It works alongside the NHI program: identity is an input to the authority check, and the check itself evaluates what the agent is about to decide against the Authority Model, in the action path, whether or not the agent was ever inventoried.