What a non-human identity is for AI agents

When an agent calls a payment API and a sub-agent it spawned calls a customer record store five seconds later, the existing identity stack has no clean answer to whose identity is on each request. Human IAM was designed for people authenticating once and acting within a session. Non-human identity is the category for everything else.

Service accounts, API keys, and bot tokens have lived under this label for years. An AI agent is a non-human identity that reasons, decides, and spawns other non-human identities at runtime. Classic NHI controls were built for static services, and agents are not static.

NHI for AI agents must resolve to a specific agent instance acting under a specific delegation chain against a specific policy context. None of that sits in the average enterprise identity store today.

Why agent spawning breaks existing identity frameworks

Agents spawn agents. The A2A protocol and the model context protocol make agent-to-agent delegation a normal runtime pattern. An agent hands a task to another agent, and the receiving agent acts on its own.

In the classic IAM model, that delegation never happens without a new authorisation step. In the agent model, the sub-agent inherits permissions from the parent by default.

If a sub-agent three hops deep takes a harmful action, the audit trail will surface the human who initiated the session, not which agent acted, on whose authority, against which data, at which step. Legacy GRC platforms cannot fix this. The issue is runtime identity capture across a chain of non-human actors.

What NIST says about agent identity

NIST launched the AI Agent Standards Initiative in January 2026, alongside the AI Risk Management Framework agentic extension. It is the first named standards body work to address non-human identity for AI agents directly.

Five pillars carry the weight: inventory of every agent in production, identity assigned at the agent instance level, least privilege at every authorisation boundary, observability across the delegation chain, continuous compliance against named obligations with evidence captured as the agent runs.

The identity pillar introduces ephemeral authentication. Agents are continuously verified across the session lifecycle, not just at login. The audit pattern is step-level: which agent instance, under which delegation chain, against which policy, with what evidence.

Three identity failures regulators will audit

Three failure patterns show up across agent deployments in regulated firms, and each maps to an audit finding supervisors are starting to write.

1. Shared credentials between agents and human users. Agents call enterprise systems using credentials cloned from real user sessions, and the audit trail resolves agent actions to the wrong identity.

2. No credential rotation for agent service accounts. Static API keys live for months because the agent runtime is treated as infrastructure. Article 9 risk management under the EU AI Act does not contemplate a credential that survives a year.

3. No delegation chain logging. The log captures only the top-level invocation. When the supervisor asks which agent took the action, the record points to a chain that no longer exists. This is what PowerPoint Governance looks like at runtime.

What proper agent identity governance looks like

Three operational controls separate identity governance that holds up under audit from a policy register that does not.

1. A unique service identity per agent instance, minted at spawn, retired at completion, never reused. Sub-agents receive their own identity at the spawn boundary, with a recorded delegation link to the parent. The identity is the audit unit, not the session.

2. Automated credential lifecycle. Credentials issued at spawn, scoped to the minimum permission set, rotated automatically, expired the moment the agent completes.

3. A full delegation chain captured as AI Evidence. Every spawn boundary, every authorisation check, every policy decision recorded, with parent-child links intact.

This is the AI Assurance Lifecycle in practice, and it maps to the AI Assurance Layer pillars.

1. Test & Detect covers pre-deployment adversarial coverage of credential misuse, prompt injection against identity boundaries, and sub-agent spawn scenarios.

2. Protect & Enforce covers inline blocking at the spawn boundary and continuous monitoring at the inference layer.

3. Prove & Comply covers step-level AI Evidence resolving to a specific agent instance under a specific delegation path, with audit-ready reporting.

Gartner agentic AI projections put 15% of day-to-day work decisions in the hands of autonomous agents by 2028. Identity attribution at the agent level becomes non-negotiable.

Bottom Line

The audit question has shifted from which user authorised this to which agent instance, under which delegation chain, against which policy, with what evidence. The existing identity stack was not designed for actors that reason, decide, and spawn other actors at runtime.

Disseqt is the only assurance layer in the industry built for the full enterprise AI lifecycle, covering testing, monitoring, policy enforcement, audit trails, and compliance reporting, unified in one platform. Firms funding Agentic AI Assurance at the inference layer will have an answer when the supervisor asks. Firms funding PowerPoint Governance will be reconstructing a chain that was never captured.

Read the platform overview