If you ship an AI agent, you have already created a new identity — and you probably haven't governed it. A non-human identity (NHI) is any credential that authenticates and acts on its own: an API key, a service account, an OAuth grant, an MCP server token. Your agent is one, and it holds several more. The scale has already tipped past humans: Palo Alto Networks' 2026 Identity Security Landscape counts 109 machine identities for every human — up from 82:1 a year earlier — and 79 of those 109 are now AI agents. GitGuardian puts the ratio nearer 80:1 and found 29 million secrets on public GitHub in 2025, riding an 81% year-over-year surge in AI-service leaks. The identity program you built for employees does not cover any of this.

That gap is now a funded category. On July 15, 2026, Oak came out of stealth with a $60M seed co-led by Accel, Greylock, and CRV to build an "AI-native identity operating system" — one control plane governing human, machine, and agent identity from a live graph. In the same window, Cisco absorbed Astrix. When two of the biggest moves in identity security this month are both about non-human identity, that's the market telling you it stops being optional.

Here's the founder-scale playbook — five moves, in order.

1. Inventory every NHI#

You cannot govern what you cannot see, and the agent you forgot is the one that leaks. Start with one checked-in registry of every agent, service account, and API key you run — provider keys (Anthropic, OpenAI), cloud roles (AWS, GCP), database secrets, MCP server tokens, CI credentials. A YAML file in the repo beats a spreadsheet nobody opens. The Cloud Security Alliance's Non-Human Identity and Agentic AI Governance whitepaper frames the same first step: enumeration before enforcement.

2. Give every NHI a human owner#

The dangerous credential isn't the powerful one — it's the orphaned one. When someone leaves and their service account keeps running, or an agent spun up for a demo never gets torn down, you get a live credential nobody will notice being abused. Every row in your registry needs an owner column. No owner, no ship.

3. Cut to least privilege#

Agents get over-provisioned because it's faster to hand them broad scopes than to reason about the minimum. Do the reasoning anyway. A procurement agent does not need write access to your production database; a research agent does not need your billing keys. Scope each credential to the one job the agent actually does, and treat every extra permission as a liability you're holding on the agent's behalf.

The dangerous credential isn't the powerful one — it's the orphaned one that nobody will notice being abused.

4. Replace static keys with short-lived, scoped credentials#

The default failure mode is a long-lived API key pasted into an environment variable, valid forever, revocable only if you remember it exists. Replace it with credentials that expire on their own: STS and OIDC for cloud roles, Vault dynamic secrets with a lease TTL for databases, a token broker that vends scoped, expiring tokens for provider keys. A credential that dies in fifteen minutes is a much smaller thing to lose. (We wrote the step-by-step version — cloud STS, Vault dynamic secrets, and a token broker — in How to Give an AI Agent a Short-Lived, Scoped Credential.)

5. Decommission on a schedule#

Identities accumulate. Without a teardown discipline, your NHI count only ever grows, and every stale one widens the attack surface. Put an expiry on the agent itself, not just its keys: a review date in the registry, a job that flags anything unused for 30 days, a default that decommissions rather than renews. Oasis and Token Security sell exactly this lifecycle — certification, rotation, decommissioning — because at enterprise scale it can't be done by hand. At your scale, it still can.

What to do this quarter#

If you do nothing else: build the registry (move 1) and close the two highest-risk gaps — any credential with no expiry and any credential with no owner. Those two columns being empty is what turns into an audit finding, a breach post-mortem, or the SOC 2 blocker that stalls your enterprise deal. The platforms getting funded this month exist because most companies skipped these five moves until it was expensive to catch up. You're early enough that it's still cheap.

The prototype question was can the agent do the job? The production question is whose credential is it holding, how far does it reach, and when does it expire? Answer that for every agent you ship, and non-human identity stops being your soft underbelly and becomes just another thing you measure — publicly, if you're us.