Non-Human Identity

Companies already run far more software identities than human ones: service accounts, API keys, cloud roles and tokens that let one system talk to another. OWASP’s Non-Human Identities Top 10 describes them as application identities usually tied to secrets used like passwords, and ranks risks such as leaked, over-privileged or long-lived credentials. Standards like SPIFFE issue identities to software workloads so services can prove who they are without hard-coded secrets.

AI agents stretch this model. In episode 60 at 10:29, Redpanda CTO Tyler Akidau argues that service accounts are not enough because agents are unpredictable and easily cloned, so each agent instance and task needs its own scoped identity. Moments later he adds that “you need a hybrid identity that carries along with it this chain of responsibility”: this is agent X, doing this task, on behalf of this person. Kyndryl’s Kris Lovejoy, in episode 62 at 44:00, lists registry, non-human identity, monitoring and policy among the controls needed to run agentic AI at scale. Both are describing what they see enterprises needing; episode 60 had no presenting sponsor (opening).

For a business, the test is whether every agent action can be traced to a specific agent, task and accountable human, with only the access that task needs. That is where identity meets least privilege, an audit trail and algorithmic accountability. Editorially, the terms are still settling: “non-human identity” comes from identity and security teams, “agent identity” from the agent world, and they overlap heavily.