Every person on your payroll follows the same arc: join, move, leave, with HR updating access along the way. A machine identity has no such arc. It gets born in a CI/CD pipeline or a late-night integration, and it never dies.
That asymmetry now defines the identity estate. Non-human identities (API keys, service accounts, OAuth tokens, workload identities, bots) outnumber humans by about 50:1 in many enterprises, yet get none of the lifecycle governance we built for people, and no HR department to retire them. Call it an identity governance vacuum.
By the end you’ll be able to say what a non-human identity is, why these identities have outgrown human-scale governance, and the direction for closing the gap. The twist: this vacuum is one facet of a digital identity estate that is fracturing, from workloads to national digital ID.
What are non-human identities, and why do they outnumber human identities?
A non-human identity is any digital identity that authenticates and is authorised on behalf of software, not a person: an application, workload, automated process, AI agent, or integration. The umbrella covers service accounts, API keys, OAuth tokens, workload identities, bots, and CI/CD pipeline identities. The Cloud Security Alliance defines the space as identities that run programmatically, at machine-to-machine speed, without the interactive checks humans get.
Separate the actor from the credential. The identity is the software actor; the API key or token is only the mechanism that proves it. Treating the secret as the whole story is how teams end up with vault sprawl and no ownership.
Machine identity is the narrower subset, the certificate-and-key, PKI-flavoured world; all machine identities are non-human identities, but not the reverse.
They outnumber us for structural reasons. Human identities multiply with HR events; non-human identities multiply with deploys, integrations, and automation. Omdia reports ratios around 50:1 in many enterprises, while the wider vendor range runs from roughly 10:1 to 500:1, with little neutral corroboration. Treat the exact multiplier as directional. The direction of travel is consistent across every source: non-human identities are the ungoverned majority.
Machines have no MFA, no logout, and no retirement, so the gap compounds unnoticed. The OWASP Non-Human Identities Top 10 catalogues the resulting risks, from improper offboarding to secret leakage to overprivileged, long-lived identities, and gives teams a vendor-neutral baseline to work from. Because these identities are token-based, they share the theft dynamics in token theft and session security.
How should I start governing non-human and machine identities across my stack?
The starting point is visibility before tooling. The vacuum is a control-plane and ownership gap, so governance has to establish accountability first. Discovery comes first: a complete inventory of service accounts, API keys, tokens, and workload identities across your business’s cloud, SaaS, on-prem, and CI/CD environments, recording where each lives and what uses it. Without that inventory, little else is possible. Many enterprise identities have no owner in HR systems, and plenty have gone more than a year without rotation.
The next layer is a named human owner attached to every identity, a person, not a team alias. Accountability to a real person keeps an identity from drifting out of sight.
On top of ownership sit lifecycle controls: rotation, expiry, least privilege, and deliberate decommissioning. With no HR offboarding trigger, retirement has to be designed in. This is direction and framework, not a runbook.
The OWASP Non-Human Identities Top 10 is the sensible baseline for what to govern. For agentic identities, NIST’s AI Agent Standards Initiative is the emerging response: AI agents spawn tokens, credentials, and sessions mid-task and decide which APIs to call at runtime.
Secrets management is operational tooling for storing and rotating credentials; governance is the control-plane discipline above it: policy, discovery, inventory, and named ownership. If you’re weighing build versus buy for that tooling, we covered it in build vs buy authentication infrastructure.
Why did the UK government scrap its BritCard digital ID scheme?
The same decentralising pressure that leaves machine identities ungoverned is now showing up in national digital ID, and the news from the UK is one signal among several. In July, the UK government scrapped BritCard, with incoming Prime Minister Andy Burnham reversing his predecessor’s plan. After millions of Britons opposed it, funds were redirected toward the cost-of-living crisis. The decision marks a retreat from top-down, centralised identity provision.
The friction was both privacy-related and political, compounded by the technical weight of one central registry. A UK Parliament petition warning of “mass surveillance and digital control” picked up around three million signatures. The mandatory element was dropped after the backlash.
The emerging alternative is decentralised: verifiable credentials and decentralised identifiers let someone prove an attribute, age, right to work, or membership without exposing more than the relying party needs. The individual holds the credential directly, with no central registry in the middle. It is the opposite architecture to BritCard.
This is the same pattern seen across the machine estate. Digital identity is the umbrella concept, and the retreat from centralised provision is the human-scale echo of your governance vacuum. We’ve written more in the government identity retreat.
Wrapping it up
The governance vacuum is an ownership and control-plane gap, and vaulting alone never closes it. Discovery, inventory, and a named human owner come before any tool, because accountability is a discipline that has to be built into the estate.
Zoom out once and the pattern repeats: BritCard’s retreat from centralised provision and the shift toward verifiable credentials is the same decentralising force that left your machine identities ungoverned. The identity estate is one estate, and the machines are now its ungoverned majority. The task is now to govern every actor, human or not.
Frequently Asked Questions
Is a non-human identity the same thing as a machine identity?
No. Non-human identity is the umbrella term for any software actor that authenticates without a human in the loop. A machine identity is a narrower subset, typically the certificate and key based workloads. All machine identities are non-human identities, but not every non-human identity is a machine identity. Service accounts, API keys, and OAuth tokens are all non-human identities even when they are not certificate based.
Is it true that an API key is the identity itself?
Not quite. A credential is not the identity. The identity is the software actor, and the API key or token is simply the mechanism that authenticates it. Treating the secret as the whole story is how teams end up with vault sprawl and no ownership. You can rotate a key and still be left with an orphaned identity holding the same permissions and quietly doing its job.
Is it true that organisations really have 50 to 109 non-human identities for every human?
Those ratios are widely cited vendor figures and appear in some of the best known reporting on the problem, but neutral sources have not corroborated them. Other estimates range from roughly 10:1 to 500:1. Treat the exact multiplier as directional rather than precise. What is consistent across every source is the direction of travel: non-human identities are the ungoverned majority of the identity estate.
What happens if a non-human identity is never retired?
It becomes an orphan. A human identity follows a Joiner-Mover-Leaver lifecycle, but a machine identity born in a CI/CD pipeline simply never dies. The stale credential keeps its standing access, which makes it a stable target for attackers and a blind spot for audit. With no HR department to offboard it, retirement has to be a deliberate lifecycle control rather than an afterthought.
Who should own a non-human identity?
A named human owner, not a team alias. Attaching accountability to an actual person closes the ownership gap that lets credentials drift into orphan status. That owner is responsible for the identity’s lifecycle: rotation, expiry, least privilege, and decommissioning. A shared mailbox or a department name is a dodge, because when something goes wrong there is no one person to answer for it.
Is non-human identity governance just another name for secrets management?
No. Secrets management is operational tooling for storing and rotating credentials. Governance is the control-plane discipline that sits above it: policy, discovery, inventory, and named ownership. You can vault every secret perfectly and still have no idea who owns an identity or whether it should exist. Governance answers the accountability question that a vault never can.
What is the OWASP Non-Human Identities Top 10?
It is the vendor-neutral catalogue of the ten most critical risks facing non-human identities, from insecure authentication to over-privileged and orphaned identities. It gives teams a shared language and a starting framework for governance rather than another product pitch. Use it as your baseline, then layer on emerging guidance such as NIST’s AI Agent Standards Initiative for agentic identities.
How do AI agents change the way we govern non-human identities?
They break the lifecycle assumptions. An AI agent can generate credentials at machine speed and act non-deterministically, so the old model of approving each identity at creation no longer holds. Governance has to shift toward continuous discovery and ownership rather than point-in-time reviews. NIST’s AI Agent Standards Initiative is the emerging response to this new class of agentic identity.
Can I just vault all my secrets and call it done?
Vaulting solves storage, not governance. A vault keeps secrets safe at rest and helps with rotation, but it cannot tell you whether an identity should exist, who owns it, or whether its permissions are still appropriate. The vacuum is an ownership and control-plane gap, so visibility and accountability have to come before any tooling decision.
What are verifiable credentials, and how do they differ from BritCard?
Verifiable credentials are a decentralised model where the individual holds and shares cryptographically provable claims rather than relying on a central government ID. BritCard was the opposite: a top-down, centralised scheme. Its scrapping marks a retreat from centralised provision and a shift toward the decentralised pattern already reshaping the wider digital identity estate.
Does the BritCard decision affect my organisation’s identity strategy?
It is a signal, not a direct regulation. BritCard’s scrapping shows the friction that centralised identity schemes hit across privacy, politics, and technology. For organisations, the lesson is that the identity estate is fracturing and decentralising at every level. The same force that stalled BritCard is leaving machine identities ungoverned, so plan for federated and decentralised models.
How is non-human identity governance different from traditional IAM?
Traditional IAM was built around human lifecycles: a person joins, moves, and leaves, with an HR event triggering each change. Non-human identities have no HR department and multiply with every deploy and integration. Governance has to start from discovery and inventory, then attach a named owner, because the human-scale controls that IAM assumes simply do not apply.
