What are non-human identities (NHI)?

Humans arrive through HR, so identity systems hear about them. Service accounts arrive through a script, a deployment pipeline or a developer in a hurry — no onboarding event, no owner of record, no leaver process. Credentials get long lifetimes because rotation breaks things, permissions get broad because narrow ones cause tickets, and years later nobody can say what a given account is for — only that deleting it is scary. AI agents compound this: they act with delegated human-like permissions at machine speed.

The controls are the same as for humans — inventory, ownership, least privilege, lifecycle, rotation — but applied at a scale manual processes cannot reach, across applications that were never designed to expose their machine accounts. That makes NHI governance an identity-operations problem: platforms like Way Security automate discovery and onboarding of accounts across the estate, including the legacy systems where the oldest and riskiest service accounts hide.