# Topic
6 articles on this subject.
I pointed nhi-scan at a real Entra tenant with 614 non-human identities. The 80:1 ratio became a worklist — and the top finding was a false positive: 53 "long-lived secrets" that were really 1. What a real NHI scan reveals, and why context beats raw counts.
Running my NHI tool against a real 600+ identity Entra tenant exposed three things unit tests missed: it didn't run on Windows, the enriched scan took 40 minutes, and it mistook managed identities for stored secrets. The fixes — including a 20x speedup — and why dogfooding matters.
Buried in a Microsoft Graph reference is a list of permissions that cannot be granted to an AI agent identity at all. Read backwards, it's the first enforced authority model for agents — six prohibitions worth applying to every agent platform you run, not just Entra.
An AI agent's reach is the one thing that can grow without anyone touching the identity — give it a new tool or connector and its blast radius expands while privilege, credential age, and owner all look unchanged. Here's why point-in-time posture scans miss it, and how to close the gap.
A practitioner control framework for governing non-human and agentic identities: eight principles, a four-tier risk model, thirty-five controls across eight domains, an agentic threat model, and a maturity model — mapped to OWASP NHI Top 10, NIST AI RMF, CSF 2.0, and 800-53.
Non-human identities are the enterprise's largest and least-governed identity population, and AI agents just added autonomy to the problem. Here is why the next identity crisis is already here — and the discipline that answers it.