Non-Human Identity
A non-human identity is any identity in a system that belongs to a machine rather than a person: a service account, an API key, an OAuth client, a workload identity, or an AI agent. These identities authenticate and act on their own, often with standing credentials and broad scopes, and they now outnumber human identities in most enterprises by a wide margin. AI agents are a fast-growing category of non-human identity, because each agent authenticates to model endpoints and tools, makes autonomous requests, and needs its actions attributed to a distinct, verifiable identity.
How non-human identities differ from human ones
A human identity logs in through an interactive flow, often with multi-factor authentication, and acts within a session that expires. A non-human identity typically holds a long-lived secret (an API key or certificate), authenticates without human interaction, and runs continuously. That combination, persistent credentials plus autonomous action, is why a compromised service account or leaked API key is so useful to an attacker: it grants standing access with no human in the loop to notice anomalous behavior.
Why AI agents sharpen the problem
An AI agent decides at runtime which tools to call and which model requests to make, so the same identity can produce a benign query one second and a data-exfiltration attempt the next. Attributing each action to the agent's verified identity, and authorizing each action against policy, is what makes agent behavior auditable. DeepInspect binds every AI request it inspects to the identity context that issued it and evaluates policy per request, so the audit record answers which agent identity did what, rather than logging a shared key with no owner.
Related reading
- Non-Human Identity for AI Agents: Why Service Credentials Are the Wrong Primitive
Non-human identity covers the API keys, OAuth tokens, and workload identities that authenticate services and agents to APIs. AI agents have outgrown the static-service-credential model. A single agent can act on behalf of many users, hold delegated authority that varies by task, and produce decisions that need per-action attribution. This piece walks through the four properties an NHI for AI agents must have, why static API keys fail each of them, and how identity-bound policy at the AI request boundary closes the gap.
- AI Agent Identity: NIST Pillar 1 in Production Deployments
NIST Pillar 1 names verified agent identity as the foundation of the AI agent identity and authorization framework. Per-agent identifiers, delegated authority from the authorizing user, and structured propagation to the model API call are the production requirements. Static service credentials fail the test.