Technically, AI agents are non-human identities. Practically, treating them like NHIs is what's breaking enterprise security in 2026. Silverfort, Strata, and the NHI Management Group are all on record saying so. The distinction sounds like security pedantry until you watch a static NHI policy fail to contain an agent that just made a new tool call you never authorized.
## Key takeaways
- Enterprises now manage 144 machine identities per human, growing 44% year over year.
- AI agents technically fall under NHIs, but Silverfort, Strata, and the NHI Management Group argue the legacy NHI model breaks for agents.
- The core difference: NHIs are static and scoped at provisioning. Agents are dynamic and adapt their access during runtime.
- Treating an AI agent like a service account leaves over-privileged access at rest and no behavioral baseline.
- The Agentic Trust Framework (CSA, February 2026) adds the five questions NHI frameworks don't answer.
## What's a non-human identity (NHI)?
A non-human identity is any credential, API key, service account, or token that lets software (not a person) access systems, data, or services. The category covers service accounts, machine identities, workload credentials, and OAuth client secrets. Microsoft Security characterizes them as the credentials that authenticate one piece of software to another.
The NHI space exploded in the last five years. Enterprises now run 144 machine identities for every human one, and that ratio is climbing 44% annually according to industry baselines cited in early 2026.
## Why are people calling AI agents NHIs?
The categorical logic is straightforward. An AI agent isn't a person. It needs credentials to access systems. By definition, that's a non-human identity. Most enterprise identity tools (CyberArk, Okta, SailPoint, BeyondTrust) added AI agent governance to their NHI feature sets in 2025-2026. The vendor framing reinforces the grouping.
## Why AI agents aren't really NHIs (the position)
Silverfort published the clearest version of the counter-position in May 2026: AI agents are not NHIs, and they should not be treated as such. Grouping AI agents under the NHI umbrella is not only inaccurate, it can create security risks. Strata's identity playbook makes the same argument: legacy NHI models assume static credentials granted at provisioning. AI agents need dynamic identity scoping that adjusts as the agent decides what to do.
The mechanical difference comes down to four points:
- Provisioning model. NHIs get scoped credentials at creation. Agents need scope that adjusts at runtime based on the task.
- Behavior pattern. NHIs run fixed operations on a schedule. Agents reason, plan, and pick actions on the fly.
- Trust boundary. NHIs operate inside a single trust zone. Agents cross trust zones during normal operation.
- Audit trail. NHIs produce a flat API log. Agents produce a reasoning trace that needs to be auditable and reconstructable.
## What controls do AI agents need that NHIs don't?
Five controls that NHI frameworks miss, mapped to the Agentic Trust Framework (CSA, February 2026):
- Dynamic scoping (Who is it). The agent's identity supports scope adjustment per task, not a single grant at provisioning.
- Behavioral baselining (What is it doing). You know what normal looks like for this agent, with anomaly detection on tool-call sequences.
- Semantic verification (What is it using). Inspect inputs and outputs at the action level. Static NHI tools don't read prompts.
- Blast radius enforcement (Where can it go). Microsegmentation that limits damage when the agent picks a wrong action.
- Kill switch (What if it goes rogue). Per-agent revocation that cuts in-flight tasks fast, with audit-grade reconstruction.
If your NHI platform doesn't do these five, you have an NHI platform, not an AI agent platform. That's fine. It just doesn't extend.
## How does this change your identity stack?
The pragmatic 2026 stack puts AI agents adjacent to your NHI platform, not inside it. Three patterns are emerging: a dedicated agent-specific identity provider that issues per-task scoped credentials, an NHI platform with an agent module (CyberArk, Okta, and Silverfort all shipped these in 2026), or a hybrid with a policy engine in the middle (Cedar, OPA, or commercial equivalent). Most enterprises end up in the hybrid pattern by Q3 2026.
The decision isn't NHI versus agent identity. It's whether you accept that agents need a dynamic enforcement layer that static NHI tooling doesn't provide.
## What's in this week's Trusted Agents?
The blog post stops here. The full briefing in Trusted Agents goes deeper:
- The vendor comparison: which NHI platforms have a real agent module versus a slide deck.
- The reference architecture for the hybrid pattern, with policy engine integration.
- The migration path off treating agents as NHIs without rebuilding your identity stack.
Trusted Agents is my weekly newsletter on AI agent security for business leaders. Subscribe at trustedagent.substack.com.
## Frequently asked questions
Are AI agents NHIs or not? Technically yes, practically no. Every AI agent uses non-human credentials, so it's an NHI by definition. But Silverfort, Strata, and the NHI Management Group argue that legacy NHI controls miss the dynamic, autonomous behavior that defines an agent.
What's the 144:1 ratio? Enterprises now manage 144 machine identities for every human identity, growing 44% year over year, cited in 2026 Microsoft Security and CyberArk research. AI agents accelerate it by spawning sub-agents and ephemeral credentials at runtime.
Can I just use my existing NHI platform for AI agents? For provisioning and credential storage, yes. You'll need additional tooling for behavioral baselining, semantic verification, and per-action authorization. Most enterprises end up with a hybrid stack by Q3 2026.
Will my SOC 2 auditor accept treating AI agents as NHIs? Increasingly no. SOC 2 CC6 controls now flag shared service-account identity across agents (breaks attribution) and absent deprovisioning workflows (creates zombie agents).
How does this relate to the Agentic Trust Framework? ATF (CSA, February 2026) defines five questions: identity, behavior, data flow, blast radius, kill switch. NHI tools answer identity and partially answer blast radius. The other three need agent-specific controls.
Joshua Woodruff is the author of Agentic AI + Zero Trust (foreword by John Kindervag) and a CSA Research Fellow. The Agentic Trust Framework was published by the Cloud Security Alliance in February 2026.