← Full glossary
Non-human identity (NHI)
seguridadNHI · machine identity
A non-human identity is a credential or account that software (a service, script, pipeline or AI agent) uses, instead of a person, to access systems and data.
Implementa's formulation. Non-human identities include service accounts, API keys, tokens, pipeline secrets and, increasingly, AI agents with their tools. They multiply faster than human ones and often lack an owner, an expiry date and a review. They matter in AI operations because an agent inherits the scope of the credentials it is given: governing them is a precondition for governing the agent.
How it differs from
- Agent identity
- Agent identity is that of a specific agent with an owner and lifecycle; NHI is the broader category that also covers services and scripts.
- Service account
- A service account is one type of NHI; not every NHI is a service account.
Examples
- An API key for an MCP server that an agent uses to read the CRM.
- A pipeline service account running a reconciliation flow with nobody assigned as owner.
FAQ
- Why do they matter for AI Operations?
- Because every agent acts with credentials. Without an inventory and an owner for those identities, what the agent does cannot be bounded or audited.
- Is it a formal standard?
- It is a widely used identity-security term with no single normative definition; this is Implementa's formulation.
Related terms
Sources & further reading
- Help Net Security, SailPoint Agentic Fabric · 2026-10-06