Open Access
Non-Human Identity as the Primary Attack Surface: A Governance Architecture for AI Agent Credentials in Regulated Multi-Cloud Enterprises
4
Independent Researcher, USA
Abstract
Non-human identities now outnumber human identities in many enterprise environments and frequently hold persistent, poorly reviewed privilege. AI agents amplify the exposure, because an agent selects tools, retrieves data, and executes actions without continuous human involvement, which means an identity can be technically valid while the action it chooses is outside its original business purpose. This paper proposes a governance architecture that gives every service, workload, and agent a named owner, a verifiable identity, constrained authorization, short-lived credentials, continuous behavioral monitoring, and rapid revocation. The architecture treats a non-human identity as a governed security object carrying a lifecycle, a dependency graph, a risk tier, an action boundary, and an evidence record. For AI agents it separates the identity of the agent from the authority of each tool call, so that authenticating as an agent does not by itself authorize what the agent proposes to do. Governance is unified across clouds while provider-native enforcement is preserved rather than replaced, which lets an organization answer both who a workload is and what it may do at this moment. The architecture is proposed and synthesized from production control experience; it is not presented as a deployed enterprise control plane, and the paper states which quantities remain unmeasured.
Keywords
Non-human identity,
machine identity,
AI agent identity,
workload identity
References
OWASP Foundation, "OWASP Top 10 Non-Human Identity Risks," 2025.
Verizon, "Data Breach Investigations Report," 2026.
S. Rose, O. Borchert, S. Mitchell, and S. Connelly, "Zero Trust Architecture," NIST SP 800-207, Aug. 2020. DOI: 10.6028/NIST.SP.800-207.
R. Chandramouli and Z. Butcher, "A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Location Environments," NIST SP 800-207A, Sep. 2023. DOI: 10.6028/NIST.SP.800-207A.
K. Tallam, "Authorization Propagation in Multi-Agent AI Systems: Identity Governance as Infrastructure," arXiv:2605.05440, 2026.
X. Yu, H. Geng, X. Zeng, and W. Knottenbelt, "SUDP: Secret-Use Delegation Protocol for Agentic Systems," arXiv:2604.24920, 2026.
K. Patil, "SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems," arXiv:2604.02767, 2026.
U. Uchibeke, "Before the Tool Call: Deterministic Pre-Action Authorization for Autonomous AI Agents," arXiv:2603.20953, 2026.
G. Zhu and C. Wang, "Intent-Governed Tool Authorization for AI Agents," arXiv:2606.22916, 2026.
S. V. Kodathala, "aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents," arXiv:2607.05518, 2026.
S. T. Avirneni, "Identity Control Plane: The Unifying Layer for Zero Trust Infrastructure," arXiv:2504.17759, 2025.
S. T. Avirneni, "Intent-Aware Authorization for Zero Trust CI/CD," arXiv:2504.14777, 2025.
R. N. Rajendran, S. K. Anumula, D. K. Rai, and S. Agrawal, "Zero Trust Security Model Implementation in Microservices Architectures Using Identity Federation," arXiv:2511.04925, 2025.
R. M. Sharma, "Ethical Hyper-Velocity (EHV): A Hardware-Rooted Zero-Trust Runtime Enforcement Architecture for Agentic AI Systems," arXiv:2605.17909, 2026.
S. J. Lazer, K. Aryal, M. Gupta, and E. Bertino, "A Survey of Agentic AI and Cybersecurity: Challenges, Opportunities and Use-case Prototypes," arXiv:2601.05293, 2026.
B. Campbell, J. Bradley, N. Sakimura, and T. Lodderstedt, "OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens," RFC 8705, Feb. 2020. DOI: 10.17487/RFC8705.
D. Fett, B. Campbell, J. Bradley, T. Lodderstedt, M. Jones, and D. Waite, "OAuth 2.0 Demonstrating Proof of Possession (DPoP)," RFC 9449, Sep. 2023. DOI: 10.17487/RFC9449.
Most read articles by the same author(s)
- Haruto Nakamura, Yui Takahashi, Adaptive Authentication Framework for Agentic AI Ecosystems: Protocol Design, Trust Evaluation, and Security Analysis , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 09 (2026): Volume 03 Issue 09
- Dr. Tanvi Das, James D. Walker, A FEDERATED MULTI-MODAL SYSTEM FOR INSIDER THREAT DETECTION IN ENERGY INFRASTRUCTURE USING BIOMETRIC AND CYBER DATA , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 01 (2025): Volume 02 Issue 01
- Prof. Emily Zhang, Luca Romano, DEFENDING AGAINST EVOLVING CYBER THREATS: A HYBRID FRAMEWORK FOR ATTACK PATTERN ANALYSIS AND INTELLIGENCE INTEGRATION , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 04 (2025): Volume 02 Issue 04
- Nguyen Minh Khoa, Tran Thi Lan Anh, Strategic Business Transformation through Data Analytics, Sustainable Practices, and Innovation Management , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 09 (2026): Volume 03 Issue 09
- Julia H. Whitaker, PROACTIVE CYBER THREAT HUNTING AND PREDICTIVE INTELLIGENCE IN CLOUD-ENABLED CRITICAL INFRASTRUCTURE: AN INTEGRATED FRAMEWORK FOR RESILIENT DIGITAL ECOSYSTEMS , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 02 (2026): Volume 03 Issue 02
- Dr. Mariam Al-Falasi, Dr. Tao Zhang, AUGMENTING SIEM WITH THREAT INTELLIGENCE FOR PREDICTIVE CYBER DEFENSE: A PROACTIVE THREAT HUNTING APPROACH , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 03 (2025): Volume 02 Issue 03
- Dr. Nyra Quellin, Strategic Risk-Based Cybersecurity Governance: Integrating Policy Frameworks, Organizational Controls, and Compliance Mechanisms for Contemporary Information Systems , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 01 (2026): Volume 03 Issue 01
- Ms. Shivani Jain, A Survey on Deep Learning Approaches for Malware Detection and Classification , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 08 (2026): Volume 03 Issue 08
- Hiroshi Tanaka, Yuki Nakamura, Improving JWT Security Through Dynamic Token Binding and Behavioral Context Analysis , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 09 (2026): Volume 03 Issue 09
- Ashutosh Palia, CMDB Data Governance and Business Continuity: Identifying Research Gaps in AI-Driven IT Operations , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 09 (2026): Volume 03 Issue 09
Similar Articles
- Dr. Alistair C. Finch, From Reactive to Predictive: A Framework for Integrating Threat Intelligence with SIEM for Proactive Threat Hunting , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 10 (2025): Volume 02 Issue 10
- Elena M. Kovacs, Predictive Intelligence Across Physical and Financial Systems: A Comparative Research Framework for Packed-Bed Thermal Energy Storage and AI-Driven Forecasting , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 03 (2026): Volume 03 Issue 03
- Dr. Elena Marovic, Dr. Sofia Markovic, Cybersecurity Governance and Resilience in Small and Medium-Sized Enterprises: A Socio-Technical, Resource-Based, and Regulatory Framework for Sustainable Digital Competitiveness , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 04 (2026): Volume 03 Issue 04
- Muhammad Hasnain, Algorithmic Abuse: How Social Platforms Amplify Revenge Porn, digital grooming and Sexual Coercion , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 04 (2026): Volume 03 Issue 04
- Ms. Shivani Jain, A Survey on Deep Learning Approaches for Malware Detection and Classification , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 08 (2026): Volume 03 Issue 08
- Daniel Okonkwo, AI-Powered Adaptive Threat Intelligence and Risk Mitigation Framework for Secure SAP S/4HANA Manufacturing Integration , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 08 (2026): Volume 03 Issue 08
- Muhammad Hamza Khan, Ayesha Noor Malik, AI Governance and Cybersecurity Policy in the Public Sector: Balancing National Security, Data Privacy, and Ethical Risk , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 08 (2026): Volume 03 Issue 08
Previous
31-37 of 37
You may also start an advanced similarity search for this article.