Non-Human Identity
Simple Definition
A non-human identity, often shortened to NHI, is an account or credential that represents software rather than a person: a service, a script, a server, a bot, or an AI agent.
Plain-English Explanation
Every system that logs in needs an identity. People have user accounts. Software has service accounts, API keys, cloud workload identities, OAuth app registrations, and bot accounts. In most companies these non-human identities already outnumber human ones, and security teams have managed them for years.
AI agents add a new and fast-growing group. An agent that reads a CRM, files tickets, queries a database, or calls a cloud API needs authenticated access, and it often acts with more independence than a traditional script. That makes the old NHI questions more pressing: who owns this identity, what can it reach, when does its credential expire, and how quickly can it be shut off?
Example
A company gives its support agent a dedicated service identity that can read help-center articles and create draft replies in the ticketing system, but cannot issue refunds or see payment data. Every action is logged under that identity, its token expires after a set period, and an engineer is listed as its owner.
How to Secure One
The same principles apply as for any privileged account: least privilege, short-lived credentials, regular rotation, logging of every action, a named human owner, an expiry date, and fast revocation. A credential broker can keep the underlying secret out of the agent entirely, and AI permission hygiene covers the habits for keeping access narrow.
How It Differs From Related Terms
A human account represents a person and is usually tied to their login, devices, and responsibilities. A non-human identity represents software, which means nobody may notice when it is misused unless it is logged and owned. Enterprise-managed auth is how an organization controls access in general; NHIs are one category of identity that system has to manage.
Related Terms
- Credential Broker, a way to let agents authenticate without holding secrets
- Authorization Gate, a check before an identity’s action takes effect
- Approval Policy, rules for what an agent identity may do unattended
- AI Permission Hygiene, keeping each identity’s access minimal
- Action Boundary, technical limits on what an identity can reach
Continue learning
Explore related guides, tools, workflows, and prompts that help you go deeper into this topic.
Browse all AI terms.
Learn termSee these concepts in practice.
Open workflowA simple explanation of this AI concept.
Learn termA simple explanation of this AI concept.
Learn termA simple explanation of this AI concept.
Learn termA simple explanation of this AI concept.
Learn termSee AI terms in action
Browse practical AI workflows that use the concepts in this glossary.
Frequently Asked Questions
Is non-human identity a new AI term?
No. Non-human identity is an established cybersecurity concept that covers service accounts, API keys, workload identities, and bots. AI agents make it more important because they are a fast-growing kind of software that needs its own access to apps and data.
Should an AI agent use my account or its own identity?
Where possible, its own. A separate identity can be given only the access the agent needs, logged separately, and revoked without touching your account. Sharing your login makes it hard to tell what you did from what the agent did.
Last updated: