Tech, ExplainedNetworking, infrastructure and security
Concept

Non-human identity

Logins that belong to software, not people.

HOW IT WORKSAn administratorcreates an identityfor a programThe identity is givena credential: a secretkey or a certificateThe program logsin automatically,at any hour, withno person presentIt never joins, movesor leaves, so nobodyreviews its accessA named owner, narrowpermissions andfrequent key changeslimit the riskSoftware logins outnumber people and are rarely reviewed, so each one needs an owner and only theaccess it uses.HOW IT WORKSAnadministratorcreates anidentity fora programThe identityis given acredential: asecret key ora certificateThe programlogs inautomatically,at anyhour,with noperson presentIt neverjoins, movesor leaves,so nobodyreviewsits accessA namedowner, narrowpermissionsand frequentkey changeslimitthe riskSoftware logins outnumber people and are rarely reviewed, so each one needs an owner and only theaccess it uses.HOW IT WORKSAn administrator creates an identity fora program↓The identity is given a credential: asecret key or a certificate↓The program logs in automatically, at anyhour, with no person present↓It never joins, moves or leaves, sonobody reviews its access↓A named owner, narrow permissions andfrequent key changes limit the riskSoftware logins outnumber people and are rarely reviewed,so each one needs an owner and only the access it uses.
A program is given an identity and a key, logs in by itself at any hour, and is kept safe by a named owner, narrow permissions and keys that are changed often.
opens a page inside this one a page in the same scene a page in another scene a concept page a label only, with no page

A non-human identity is a login that belongs to software rather than to a person. Service accounts, API keys, access tokens, certificates and, now, AI agents are all non-human identities. A service account is an account that a program uses, not a person. In a large company, these identities far outnumber the employees, often by dozens to one.

Here is how it works in general. A developer or an administrator creates the identity for a program. The identity is given a credential, the proof it uses to log in. The credential can be a secret key, which is a long password, or a certificate. The program stores the credential and uses it to log in to other systems automatically, at any hour, with no person typing anything. The identity is also given permissions to read or change certain data.

This is where the risk comes from. A person joins, changes jobs and leaves, and the HR system tells the identity system each time. A program never does any of this. So its access is rarely reviewed, its key may never expire, and nobody may remember who owns it. It cannot use multi-factor authentication, because there is no person to receive a code. Programs are also often given wide permissions, because that is quicker. So a stolen key can open a great deal, without anyone noticing.

The answer is to treat each one like an employee. It gets a named owner, and only the access it needs, as least privilege requires. Its key is replaced often. Secrets management keeps the keys in a vault and changes them automatically. Cloud entitlement management finds cloud identities with wider permissions than they use.

Take, for example, a payroll application that reads attendance data from another system every night through an API. It logs in with an API key. If that key is copied into a public code repository by mistake, anyone who finds it can read the attendance data.

Consider the thousands of websites and internal servers that prove who they are with certificates. Certificate lifecycle management finds every certificate and renews it before it expires.

Imagine an airline that lets an AI agent rebook passengers' tickets. AI agent identity and security gives the agent its own login, narrow permissions and a record of every action it takes.

How is a non-human identity different from a hard-coded secret? The identity is the account. The secret is the key that opens it. A hard-coded secret is a key written into a program's code, where others can find it. It is one of the commonest ways a non-human identity is stolen.

Appears in

Networking, infrastructure and security
Tech, Explained is a part of ingrid.fyi. Every page explains one piece of technology in plain words.