Auditing non-human identity

Setting scope

Auditing "all non-human identities" is not tractable in a first engagement; a mid-sized enterprise has tens of thousands. Scope by blast radius instead: identities that can read or write production data, identities that cross a trust boundary into a third party, and identities with unbounded credential lifetime. That intersection is usually a few hundred, and it is where the material risk sits.

Record the scoping rationale. If a subsequent incident involves an identity you excluded, the documented rationale is what distinguishes a scoping decision from an oversight.

What to request

1. The non-human identity inventory, as an export with a generation timestamp, including owner, purpose, credential type, expiry, and systems reached.
2. Evidence of how the inventory is maintained: automated discovery cadence, or a documented manual process with dated runs.
3. Credential lifetime distribution. How many have no expiry.
4. Access review records for non-human identities specifically, showing reviewer, date, decision, and action taken on revocations.
5. Joiner-mover-leaver evidence for owners. When an owner leaves, what happens to their identities?
6. Revocation evidence: a case where a credential was revoked, with timestamps for revocation and confirmed loss of access.
7. Exception register with named approver and review date for every identity that cannot meet policy.
8. For agents: logs showing an action attributed to both the agent and the delegating human.

What good evidence looks like

The distinction is reproducibility. Evidence a control operated is evidence you can regenerate and re-test. An assertion that it operates is not.

Six findings that recur

1. Access reviews exclude non-human identities. The review process was built for humans and nobody extended it. Near-universal.
2. Ownership recorded as a team. When accountability is a mailbox, nobody is accountable, and offboarding never triggers.
3. Orphaned identities belonging to departed staff. Test this directly: sample leavers from the last twelve months and trace their non-human identities.
4. Unbounded credential lifetime with no exception record. Not a policy breach if it is registered and approved; a finding if it is invisible.
5. Third-party integrations outside the inventory. OAuth grants to SaaS applications are usually created by business users and rarely appear in a security-owned inventory. See Salesloft/Drift.
6. Revocation never tested. The control is designed and documented and has never been exercised.

Auditing AI agents

Everything above applies, plus one test that is specific and decisive: take a consequential agent action from the logs and attempt to reconstruct who authorised it.

If the log records only a service principal, the organisation cannot evidence human oversight, which has consequences under EU AI Act obligations and under an ISO/IEC 42001 management system. This is not a hypothetical future requirement; it is a present clause 9.1 evidence problem.

Secondary tests worth running: whether any agent holds a human's credential (a finding on its own), whether agents appear in the access review population, and whether there is an inventory of agents the organisation did not build but has granted access to.

Frequently asked questions

What is the most common finding in a non-human identity audit?

Access reviews that cover human accounts and silently exclude non-human identities. The review process was designed for humans and never extended, so service accounts, API keys, OAuth grants and agent credentials are never recertified. This appears in nearly every engagement and is usually straightforward to remediate once identified.

What counts as adequate evidence for non-human identity controls?

Reproducible, dated records rather than assertions or dashboards. A dated inventory export with owner and expiry columns populated, review records showing reviewer and decision and executed revocations, rotation logs with timestamps for a sampled set, and a revocation drill record showing both revocation time and confirmed loss of access. The test is whether you could regenerate and re-verify the evidence independently.

How should an auditor scope a first NHI audit?

By blast radius rather than by system inventory. Take the intersection of identities that reach production data, identities that cross a trust boundary to a third party, and identities with unbounded credential lifetime. In a mid-sized enterprise that is typically a few hundred identities rather than tens of thousands, and it is where material risk concentrates. Document the scoping rationale.

How do you audit an AI agent?

Apply the standard non-human identity tests, then add the decisive one: select a consequential action from the logs and attempt to reconstruct who authorised it. If the log shows only a service principal, the organisation cannot evidence human oversight, which is a present evidence gap under ISO/IEC 42001 clause 9.1 and relevant to EU AI Act record-keeping obligations.