A human identity can use MFA and passkeys. A machine identity, such as a service account, CI job or AI agent, cannot approve a prompt. It needs other controls: narrow scope, short lifetimes, a named owner, and federation in place of stored keys wherever the platform supports it.
What counts as a machine identity
Service accounts, API keys, CI runner tokens, deploy keys, OAuth apps and, increasingly, AI agents that call tools on someone's behalf. They tend to outnumber people and often hold broad rights because they were set up in a hurry.
Why human controls do not carry over
- No MFA prompt, so a stolen key works on its own.
- No natural offboarding event, so unused identities linger.
- Keys are copied into CI settings, config files and laptops.
- One shared credential often serves many services, which OWASP lists as something to avoid.
Controls that fit machines
Short-lived credentials. OWASP recommends issuing credentials per session with short leases and revoking them afterward, using static secrets only where the service cannot issue temporary ones.
Federation instead of stored keys. GitHub's documentation says that if a cloud provider supports OpenID Connect, workflows can authenticate directly so you can stop storing long-lived credentials as secrets. See OIDC vs static credentials in CI.
One identity per workload. Do not share a key across services, so you can revoke one without touching others, and so logs show who did what.
Ownership and purpose. OWASP asks you to record owner, purpose, secret type and rotation requirements.
Scoped access. Restrict who can impersonate service accounts and what each can reach.
Monitoring. Watch which identity accessed which secret, from where, and alert on anomalies.
A 30 minute starter audit
- Export the list of service accounts and tokens.
- Mark those with no owner.
- Mark those unused for months, using last-used data where available.
- Check which ones hold admin rights.
- Replace the worst with federated or short-lived access, starting with CI.
Safeguard has agent identity and asset discovery for finding and governing non-human actors, and policies, gates and guardrails for enforcing rules. The free scan at gold.safeguard.sh/scan is a way to try it on a repository.
Keep the audit going after the first pass. New integrations appear every week, and each one can add a token nobody tracks. Make owner and purpose required fields when a service account or key is created, and block creation without them where your tooling allows. A short monthly review of newly created non-human identities is enough to catch drift before it turns into a large cleanup project.
Quick check
Is a long-lived API key ever acceptable?
OWASP allows static secrets for services that cannot issue temporary credentials. Scope it narrowly, record an owner and rotate it.
Do AI agents need their own identity?
Giving each agent its own identity, rather than a shared user token, lets you scope and revoke it separately.
Sources
Last reviewed: 19 October 2026.
