# Govern non-human and agentic identities

Non-human identities — service accounts, API keys, workload identities,
certificates, secrets — already outnumber human accounts in most environments,
often many times over. Now AI agents are joining them, acting on their own and
frequently running on credentials no one has audited. They're where the
least-watched risk hides, because the tools built for human users weren't built
to see them.

## Bring them into view

Axiad Mesh treats non-human identities as first-class. It correlates and scores
service accounts, machine identities, certificates, and AI agents the same way it
does human users — so they appear in the same
[risk model](../concepts/risk-scoring.md), ranked against everything else rather
than living in a blind spot.

For AI agents specifically, Mesh maintains an inventory of the autonomous agents
active in your tenant — what each one is, who owns it, where it came from, and the
risk it carries — so the agents operating in your environment are accounted for
instead of invisible.

![An NHIs-by-type inventory in Axiad Mesh Generative UI, listing non-human identities across kinds — workload identities, AI agents, service principals, RPA bots, managed identities, OAuth apps, service accounts — each with a risk score and dormant and no-owner counts, beside a widget chat answering which are unowned](/img/generative-ui/nhi-by-type.png)

## Score the risk that's specific to them

Non-human identities fail in their own ways, and Mesh scores for it: a dormant
service account, an over-provisioned workload identity, an expiring or
weakly-signed certificate, an agent with standing access it rarely uses. Because
these roll into the same dollar-ranked model as everything else (see
[Quantify risk in dollars](./quantify-risk-in-dollars.md)), a risky machine
identity can — and often should — outrank a human finding.

## Find the owner and drive the fix

The hardest part of a non-human identity is that no one remembers owning it. Mesh
tracks ownership on every asset and surfaces a **No owner** risk when it's
missing, because an unowned credential is one nobody will rotate. From there the
standard [remediation](../concepts/remediation.md) paths apply — guided steps,
delegation to the right owner, or automated external remediation — so a finding
becomes an assigned, tracked task instead of a dead end.

## Related

- [Identities](../concepts/identities.md) — human and non-human, correlated the
  same way.
- [Risk scoring](../concepts/risk-scoring.md) — how non-human risk is measured.
- [Remediation](../concepts/remediation.md) — assigning and resolving the work.
- [Crypto agility](./crypto-agility.md) — the certificate side of non-human
  identity, end to end.