Enterprise AI Governance Best Practices

What a Non-Human Identity Is

A non-human identity is the machine identity under which a software actor authenticates and acts. Service accounts, workload identities, integration credentials, tokens, and interface keys are all expressions of it.

For an AI Agent, the non-human identity is not an administrative detail. It is the boundary of what the agent can reach, and the record of what the agent has done.

An agent that has no identity of its own cannot be governed directly. It can only be governed through whatever identity it borrowed, which means it is governed as something other than what it is.

This document treats the non-human identity as a governed property of every AI Agent, recorded in the AI Agents Inventory and connected to the systems, data, and actions the agent is authorized to reach.

Why AI Agents Require Dedicated Identities

Agents are frequently deployed under identities that already exist: a builder’s personal account, a shared service account, an integration credential created for another purpose, or an identity supplied by the platform hosting the agent.

Each of those choices removes something the enterprise needs.

A borrowed human identity destroys attribution. Actions taken by the agent become indistinguishable from actions taken by the person, and that person remains accountable for behavior they neither performed nor observed.

A shared or inherited identity grants the agent whatever access that identity already held, rather than the access its approved purpose requires. The agent’s reach becomes an accident of history rather than a governance decision, and it is usually far broader than anyone intended.

Give Every Agent Its Own Identity

The governing rule is straightforward: every AI Agent should authenticate and act under an identity that belongs to it alone.

A dedicated identity makes an agent individually attributable, individually constrained, individually reviewable, and individually revocable. None of those properties survives a shared identity.

A dedicated identity also makes the agent durable to find. An identity that exists for one agent and nothing else is a queryable record that the agent exists, and it frequently outlives the platform configuration that created it.

Where a platform cannot issue a distinct identity for each agent it hosts, that limitation should be recorded as a governance finding and an accepted risk with a named owner, rather than absorbed silently.

Scope Permissions to Least Privilege

An agent identity should carry only the access that the agent’s approved purpose and authority require.

Scope should be derived from approved authority rather than from convenience. An agent that needs to read three systems should not hold an identity that reaches thirty, and the difference between reading a system and writing to it should never be incidental.

Permission boundaries should be explicit about which systems, which data, which actions, and under which conditions. A boundary that cannot be stated precisely cannot be reviewed, enforced, or defended.

Scope should be re-examined whenever the agent’s purpose, authority, tools, or audience change. Permissions tend to accumulate quietly, and an identity whose access has grown beyond its approved authority is a form of drift that rarely announces itself.

Govern the Credential Lifecycle

Credentials issued to agents should be governed with the discipline applied to privileged human access, and with considerably more attention to expiry.

Every agent credential should have an owner, an issue date, a defined lifetime, a rotation practice, and a recorded purpose.

Long-lived credentials with no expiry are the most common failure in this area. A credential that never expires will outlive the agent it was issued for, the owner who requested it, and any institutional memory of why it exists.

Secrets should be stored and retrieved through controlled mechanisms rather than embedded in instructions, prompts, configuration, or code, where they are copied, shared, and preserved far beyond their intended use.

Use Identity as the Attribution Anchor

When an agent acts, the enterprise must be able to state which agent acted, under which identity, with what authority, and on whose behalf.

Identity is what makes that statement possible. Logs, traces, evidence records, and incident reconstructions all resolve through the identity the agent used at the time of the action.

Where an agent acts on behalf of a person or a business function, both should be recorded: the agent’s own identity and the context it was acting for. Collapsing the two loses the distinction between what a person did and what was done for them.

Attribution is not only a security concern. It is the foundation of accountability, evidence, incident response, and the ability to defend an enterprise’s conduct after the fact.

Use Identity to Discover Ungoverned Agents

Identity records are among the most reliable means of finding agents that were never registered, as set out in the guidance on establishing and maintaining the AI Agents Inventory.

Governing non-human identity makes that discovery substantially more effective. In an estate where every governed agent holds a dedicated and recorded identity, every unrecognized machine identity becomes a specific question with a small number of possible answers.

Identity governance and inventory discovery therefore reinforce one another. Weak identity governance leaves discovery guessing, and weak discovery leaves identities unexplained.

Revoke Identity When an Agent Is Retired

Retiring an agent without revoking its identity does not retire the agent. It produces an unmonitored actor with live access and no one paying attention to it.

Revocation should remove credentials, withdraw permissions, disconnect integrations, and disable the identity itself. Each step should be evidenced, because the enterprise may later need to show precisely when the agent lost the ability to act.

Identities with no owner, no associated agent record, or no recent legitimate use should be treated as active findings and traced back to the agent that created them. An unexplained identity is either an ungoverned agent or a gap in the inventory, and both require resolution.

Govern Identity for Agents That Act Through Other Agents

Some agents invoke, orchestrate, or create other agents. Identity governance must account for what happens to authority when it passes between them.

Delegated authority should never exceed the authority of the agent delegating it. An agent that calls another agent cannot confer access it does not itself hold, and an orchestrating agent should not become a route around the permission boundaries applied to the agents beneath it.

Where one agent acts through another, the chain should be recorded so that an action can be traced to the agent that performed it and to the agent that initiated it.

An agent capable of creating another agent is capable of creating another identity. Agents created this way require the same registration, ownership, scoping, and revocation as any other agent, and the ability to create them should itself be a scoped and reviewed permission.

What AI Governance Requires of Enterprise Identity and Access Management

AI governance does not replace identity and access management. It states what it requires from it.

Enterprise identity and access management should be able to issue distinct identities for individual agents, express permission boundaries that correspond to approved agent authority, support short credential lifetimes and routine rotation, attribute actions to agents distinctly from humans, enumerate non-human identities on demand, and revoke access quickly and completely.

Where agent identities are created inside platforms rather than within enterprise identity systems, the enterprise should still be able to enumerate, review, and revoke them. A platform-managed identity that the enterprise cannot see is an ungoverned identity regardless of how well the platform manages it.

These expectations should be stated in advance as governance requirements. An enterprise that discovers them during an incident discovers them too late.

Governance Questions Non-Human Identity Should Answer

For non-human identity, governance should answer which identities exist, which agent each belongs to, what each can access, which are unaccounted for, which must be revoked, and which risks, obligations, controls, evidence, incidents, changes, and gaps require action.