The "Ghost in the Machine"

Humans have "Biometrics"; NHIs only have "Secrets."

We have spent decades perfecting the art of managing Human Identities. We have onboarding rituals, background checks, MFA tokens, and “leaver” processes. We treat a human employee like a high-risk asset.

But behind the scenes, a Ghost Workforce of Non-Human Identities (NHIs)—service accounts, API keys, tokens, and AI agents—has flourished.

The core difference is one of “Visibility vs. Velocity”:

• Human Identities are managed via HR triggers. They move slowly. Their privileges are (usually) reviewed annually.

• Non-Human Identities are created in seconds by developers via CLI. They are born in a “provisioning” script, often with “Admin” rights to ensure the “app just works,” and they are almost never offboarded.

The Privileged Roll-up: Because NHIs are seen as “plumbing” rather than “people,” their permissions tend to roll up rather than stay least-privileged. A RAG pipeline agent needs to “read” a database, so it gets granted DB_Owner. A CI/CD bot needs to “deploy” code, so it gets Global_Admin.

In a PE-backed, high-growth environment, this “Secret Sprawl” is a valuation killer. When an auditor or a sophisticated threat actor looks at your stack, they aren’t looking for a weak password on a human account. They are looking for the forgotten OAuth token in a dev environment that still has a heartbeat and a “Keys to the Kingdom” permission set.

Stop managing your AI agents as “scripts.” Start managing them as unauthenticated employees with unlimited access.