Non-Human Identity
ELI5 - The Vibe Check
Non-human identity is the realization that most "users" logging into your systems these days aren't people at all, they're service accounts, CI pipelines, API keys, and AI agents, and there are usually way more of them than actual humans. Treating a robot's login exactly like an intern's login, same rotation policy, same access reviews, is how you end up with thousands of forgotten, over-privileged accounts nobody's watching.
Real Talk
Non-human identity refers to credentials and identities belonging to machines, services, and automated agents rather than people, including API keys, service accounts, and workload certificates. Because non-human identities now vastly outnumber human ones in most organizations and are harder to monitor for anomalous behavior, they've become a distinct security discipline covering discovery, lifecycle management, and least-privilege enforcement.
When You'll Hear This
"Our NHI audit found 400 service accounts nobody could explain." / "We're rolling out short-lived workload identities to cut down on standing non-human identity risk."
Related Terms
Credential Rotation
Credential Rotation is the practice of regularly changing ALL your secrets — database passwords, API keys, certificates, tokens.
IAM (Identity and Access Management)
IAM is the permission system for AWS. It controls who (users, roles, services) can do what (read S3, start EC2, invoke Lambda) on which resources.
Principle of Least Privilege
Principle of Least Privilege means everyone and everything gets only the MINIMUM access needed to do their job. The intern doesn't get admin access.
Service Account
A service account is a special non-human account that your app or service uses to authenticate with cloud APIs.
Workload Identity Federation
Instead of handing your CI pipeline a long-lived cloud password it has to keep safe forever, workload identity federation lets the pipeline show up and pro...