Managing Non-Human Identities

Digital transformation is making IT increasingly service-oriented, cloud-based, and augmented by AI, driving a surge in digital interactions among people, processes, and things. Because every interacting entity has an identity, organizations must manage identities and control access to resources to meet business, security, privacy, and compliance needs. Traditional identity and access management (IAM) is relatively mature for human identities, but it provides little support for the rapidly expanding and diverse set of non-human identities, leaving organizations exposed to security and compliance risks.

Non-human identities are emerging most prominently across four areas: devices (from laptops and smartphones to industrial sensors, robots, and autonomous devices), IT administration (shared, service, and technical accounts tied to roles rather than individuals), software-defined infrastructure (containers, microservices, networks, and APIs operating programmatically without human intervention), and AI technologies (chatbots, RPA bots, analytics processes, and self-learning algorithms). To reduce risk, organizations must ensure comprehensive visibility, traceability, authentication, authorization, and accountability for all entities—human and non-human—interacting with enterprise systems.

A core requirement is eliminating shared accounts and ensuring every entity has a unique identity linked to an accountable owner, enabling the Principle of Least Privilege. RPA highlights the danger of “super robots” with broad entitlements; instead, robots should be constrained to specific tasks, monitored for anomalous behavior, and managed through lifecycle processes integrated with standard mover/leaver workflows. Privileged access management (PAM) must also cover privileged non-human identities across production, development, and DevOps.

To meet long-term demands, IAM must evolve into a service-based “Identity Fabric”: a loosely coupled, API-centric architecture that connects everyone and everything to every digital service, supports federation and decentralized identity options, applies centralized policies dynamically, and emphasizes API security as the enforcement boundary.

• Non-human identities are emerging in four main areas: devices, IT administration, software-defined infrastructure, and AI technologies.
• Device identities to manage include desktops, laptops, smartphones, tablets, cameras, printers, industrial sensors, smart meters, industrial robots, and autonomous devices.
• IT administration non-human account types include shared accounts, service accounts, and technical accounts.
• Software-defined infrastructure identities include containers, services/microservices, networks, and APIs.
• AI-related non-human identities include chatbots, RPA bots, analytics processes, and self-learning/self-modifying algorithms.
• No entity should interact with IT systems unless it has a unique identity linked to an owner who can take responsibility for its actions.
• Each RPA software robot has an identity with associated entitlements used for authentication and authorization.
• Privileged identities are common targets for compromise by cyber criminals.
• Identity Fabrics emphasize APIs and developer-oriented tooling rather than focusing on graphical user interfaces.
• APIs function as the secure access points for the Identity Fabric, making comprehensive API security critical.

• “Failure to ensure comprehensive identity management capabilities for these identities as well as human identities is likely to expose organizations to business, security and compliance risks.”
• “At the very least, businesses need to be in control of all entities interacting with their systems.”
• “Businesses must work to eliminate shared accounts so that all human or non-human entities interacting with systems have an identity that can be managed.”
• “This avoids creating ‘super robots’ with multiple entitlements that could be exploited by hackers.”
• “The success of Digital Transformation depends on an ability to manage the access of everyone and everything to every digital service.”
• “It is unlikely that there will ever be a single provider of identities, but many different ones.”
• “These changes will result in a converged digital identity backend or ‘Identity Fabric’ that can deliver as a utility all the identity services…”
• “We use ‘fabric’ to describe a set of connected enabling IT components that work together as single entity.”
• “As the defined interfaces for calling a service, APIs are essentially the secure access points or security gatekeepers for the Identity Fabric…”
• “In the context of non-human identities, the Identity Fabric concept is a useful starting point because it provides a centralized, non-siloed, consistent and policy-based way of managing all identities.”