The Non-Human Identity Gap: Why Your SOC 2 Certifies Agents It Cannot See

If you run security or compliance at a regulated mid-market organization, a behavioral health network, a PE portfolio company, a regulated SaaS shop, a property manager handling tenant financials, you have spent years getting human identity right. Single sign-on, MFA, quarterly access reviews, joiner-mover-leaver workflows: the whole apparatus your SOC 2 Type II and your HIPAA Security Rule attestations rest on. That work was real. It is also now a minority position. The Cloud Security Alliance's non-human identity governance whitepaper, published May 20, 2026, estimates that machine identities outnumber human ones by roughly 45 to 1, and by as much as 144 to 1 in agent-heavy environments. Each AI agent, service account, and automation token holds credentials, makes calls against your data, and authenticates cleanly. What none of them can do is prove, after the fact, that the action they took was authorized. That is the gap your last clean audit certified without examining. The control model was built for humans, and it shows Identity and access management has one foundational assumption baked into every framework auditors test against: an identity maps to a person, and a person can be held accountable. SOC 2's Common Criteria for logical access (CC6) and HIPAA's access control and audit standards both presume a named human who is provisioned, periodically reviewed, and de-provisioned on termination. The artifacts auditors ask for, the access review spreadsheet, the termination log, the MFA enrollment report, are all human-shaped. An AI agent breaks every part of that assumption. It is provisioned by a developer in minutes, often with a long-lived API key copied into an environment variable. It inherits the broad permissions of whatever service account it runs under, because nobody scoped a narrower one. It does not get reviewed quarterly, because it never appears on the access review in the first place. And when it is decommissioned, its credential frequently keeps working for weeks, because revocation is a manual ticket nobody filed. GitGuardian found 1,275,105 AI-related secrets exposed on public GitHub in 2025, up 81 percent year over year, a direct readout of how casually these credentials are being minted and handled. The distinction worth holding onto: this is not the same problem as governing agent behavior. A control layer that puts a judge or validator in front of an agent's actions governs what the agent is allowed to do, which tool calls clear, which outputs ship. Non-human identity governs something upstream of that: who the agent is, how its credential was scoped, and how fast you can revoke it. You can run a perfect validator in front of an agent whose stolen token is being replayed by an attacker. The two are a sequence, not a substitute. Identity comes first. Why authentication without authorization is the whole problem Agents authenticate beautifully. They present a token, the token is valid, the call goes through. What they cannot do is carry proof that the specific action was authorized for the specific context. When CVE-2026-42824, the "SearchLeak" one-click Microsoft 365 Copilot exfiltration flaw disclosed by Varonis Threat Labs on June 15, 2026, pulls mail, MFA codes, salary data, and M&A material out through allowlisted infrastructure, it does so as a trusted, authenticated identity. The second such exfiltration class after EchoLeak, it works precisely because the agent's identity is trusted and its authority is unbounded. OWASP underlined the structural nature of this on June 11, mapping prompt injection to 6 of its 10 agentic-AI Top 10 categories. The attacker rarely needs to break your authentication. They need only to ride an identity that authenticates correctly and was never scoped to refuse. The illustrative case everyone has heard some version of, an AI coding agent that deleted a startup's production database and its volume-level backups in roughly nine seconds, is an authorization failure, not an authentication one. The agent was who it said it was. It simply held standing permission to do something catastrophic, and nothing, no scoping, no just-in-time control, stood between intent and execution. What the audit and the board will ask The questions are already forming, and they are answerable only if you have built the program ahead of the request. Expect your next SOC 2 examiner, HIPAA assessor, or board risk committee to ask: How many non-human identities exist in your environment, and where is the authoritative list? For each agent with access to regulated data, what is the minimum scope of its credential, and who approved it? When an agent is compromised or retired, what is your measured time to revoke, in minutes, and provable from logs? Can you produce a per-agent audit trail showing which identity took which action against which record? And critically: which of these agents touch PHI, cardholder data, or material non-public information, and how is that mapped to your existing control set? US Treasury's Financial Services AI RMF, published February 19, 2026, lays out 230 control objectives across seven domains, and identity governance runs straight through them. If you serve financial-services clients, those objectives are flowing into your vendor questionnaires now. The EU AI Act's GPAI enforcement powers activate August 2, 2026 with fines up to 3 percent of global turnover, and downstream deployers are expected to collect provider documentation today rather than at the deadline. The trajectory points one way: more identity-level accountability, sooner. The non-human identity program to put in place A workable NHI program for a mid-market regulated environment has five components, and the tooling to build it shipped this spring. Auth0 released an agent-native identity stack on May 21, Auth for MCP GA, "Agent as Principal," and a Token Vault. Cloudflare shipped scannable API tokens with auto-revocation and resource-scoped RBAC on April 14. The European Identity Conference converged on June 10 around OAuth 2.1 plus OpenID AuthZEN as the authorization substrate. The pieces exist; the program is assembling them. Agent identity registry. One authoritative inventory of every non-human identity, each with an owner, a purpose, the data classes it touches, and an expiry. If it is not in the registry, it does not get a credential. This is the artifact your auditor will ask for first. Just-in-time scoped credentials. Replace standing, long-lived keys with short-lived credentials minted at call time, scoped to the narrowest resource and action the task requires. An agent that reads one mailbox should not hold a tenant-wide token. Token vaulting. No secrets in environment variables, config files, or repos. Credentials live in a vault, are brokered at runtime, and never land where GitGuardian's scanners, or an attacker's, will find them. Minutes-not-days revocation. Compromise or decommission must collapse a credential in minutes, verifiable from logs. Auto-revoking, scannable tokens make this measurable rather than aspirational. Per-agent audit. Every action attributable to a specific non-human identity, mapped explicitly to SOC 2 CC6 logical-access criteria and the HIPAA access-control and audit standards, so the agent appears in the same evidence chain as a human user. What we recommend First, run a census this quarter, count your non-human identities and the data each one touches, because you cannot govern a population you have not measured, and the 45:1 ratio means the count will surprise you. Second, kill standing credentials for any agent touching regulated data and move to just-in-time scoped tokens with vaulting; this is the single highest-leverage change. Third, prove your revocation time with a tabletop: pick one agent, revoke it, and timestamp it from the logs, if the answer is days, that is your finding. Fourth, map every non-human identity to your existing SOC 2 and HIPAA control language now, before an examiner asks, and tighten the same ground on the human side using our field guide on M365 and Entra ID hardening for regulated mid-market. This is the kind of named, scoped gap the Diagnostics we run with regulated mid-market clients are built to close, identity first, before anything else governs what the agent may do. Count the identities you cannot see, or keep certifying them blind.