What's inside
One inventory. Tier-appropriate controls.
Not all NHIs are equal. A service account running a nightly backup needs different governance than an autonomous AI agent making customer-facing decisions. RapidValue's 4-tier model assigns review cadence, JIT requirements, and credential rotation policies based on tier.
Total NHIs, NHI-to-human ratio, ownership coverage
The top-line metrics tell you what's at stake: total NHIs, the ratio of NHIs to humans (industry average is 25:1, often 40+), ownership coverage, stale credential count, and high/critical risk count. Below: the 4-tier breakdown and top 5 risk NHIs.
T1 AI-Assisted
Service accounts & IoT devices — low autonomy, reuse existing IGA flows. Governance: reuse IGA policy, manual approval, yearly review. Includes the bulk of legacy service accounts.
T2 AI-Enabled
System accounts — scoped, predictable permissions. Governance: scoped permissions, 2-year review, 90-day credential rotation. The traditional "one account per app" category.
T3 Autonomous
AI agents — autonomous decisions, require JIT + behaviour monitoring. Governance: JIT access, policy-as-code, behaviour monitoring, max-24h credentials. Modern AI deployment category.
T4 AI-to-AI
Applications delegating to other agents — federation + audit chain. Governance: agent identity federation, delegation tokens, audit chain. Multi-agent orchestration category.
👤 Owner-attributed
Every NHI has an owner identity. Ownership transfers fire smart certs to the new owner. Orphaned NHIs (no owner) are surfaced as risk items. Owner is queryable, filterable, and reviewable like any other access decision.
⏱️ JIT & rotation
T3 and T4 NHIs require Just-In-Time access elevation rather than standing privileges. Credential rotation policies enforce per-tier: T2 = 90-day, T3 = 24-hour, T4 = federation tokens (no long-lived secret to rotate).
📋 NHI re-certification
The default cert-rule for NHIs (cr-nhi-ownership-yearly) reviews
T1-T4 NHI ownership every 180 days. Reviewer = manager (proxy for
NHI owner). Auto-action on deadline = flag-for-review (not revoke —
NHIs shouldn't be silently disabled and break automation).
🔍 Risk scoring
Per-NHI risk score combines: tier (higher = more weight), missing owner, credential age vs policy, unused activity window, and autonomous-without-JIT flag. Drives the "top 5 risk NHIs" surface on the dashboard.