{
 "slug": "accountable-ownership-test",
 "topic_id": "TOPIC-207",
 "cluster": "Machine, Agent & Signing Identity",
 "tier": "Tier A",
 "title": "Eighty machine identities per human, and not one has a signature behind it",
 "summary": "NHI programmes start with discovery and end with a spreadsheet of thousands of identities whose owner field contains a team name, a departed employee, or nothing. Rotation improves hygiene without establishing who authorised the identity to exist.",
 "lede": "The non-human identity category has converged on a metric — the ratio of machine identities to humans — and a remedy — discovery and rotation. The metric is real. The remedy addresses inventory and leaves the question of accountability entirely untouched.",
 "date": "2026-02-22",
 "category": "Developer",
 "author_id": "desmond-okafor-hale",
 "tags": [
  "non-human identity",
  "NHI",
  "machine identity",
  "secrets",
  "service accounts",
  "identity governance"
 ],
 "image_title": "Accountable Ownership Test",
 "schema": "Article",
 "key_takeaways": [
  "2026 research put NHI-to-human ratios between 45:1 and beyond 100:1, and reported ratios differ by more than tenfold because each vendor counts a different population.",
  "Every NHI programme discovers identities whose owner field is populated. Populated is not the same as accountable, and the sector's metrics do not distinguish them.",
  "Five properties separate ownership metadata from ownership evidence, and most estates satisfy one of them."
 ],
 "body": [
  {
   "type": "h2",
   "text": "Read the ratios carefully before using them"
  },
  {
   "type": "diagram",
   "kind": "flow",
   "alt": "The discovery project and where it stops",
   "caption": "Discovery is the easy part. Accountability is the part that does not get finished.",
   "nodes": [
    {
     "label": "Discovery run",
     "note": "thousands found",
     "good": true
    },
    {
     "label": "Spreadsheet produced",
     "note": "the deliverable"
    },
    {
     "label": "Owner field populated",
     "note": "team, leaver, or blank",
     "bad": true
    },
    {
     "label": "Rotation scheduled",
     "note": "hygiene, not accountability",
     "bad": true
    }
   ]
  },
  {
   "type": "p",
   "html": "2026 research produced a range of figures: one vendor reported NHI-to-human ratios of 45:1 from its telemetry, another reported machine identities outnumbering humans 80:1, and a 2026 identity outlook reported organisations citing machine-to-human ratios of 100:1 with some reaching 500:1. A separate analysis found that a large majority of active production identities in monitored cloud environments were non-human."
  },
  {
   "type": "p",
   "html": "Those figures differ by more than an order of magnitude, and they are not in conflict. Each counts a different population: some count cloud workload identities, some count every credential in a secrets manager, some count service principals in a directory. A ratio without a counting rule is a headline rather than a measurement."
  },
  {
   "type": "p",
   "html": "What survives all of them is directionally unambiguous: machine identities vastly outnumber humans, and the gap is widening as AI services proliferate."
  },
  {
   "type": "h2",
   "text": "Why discovery is not the answer it appears to be"
  },
  {
   "type": "p",
   "html": "An NHI programme follows a predictable arc. Deploy discovery, produce an inventory, find far more identities than expected, prioritise by privilege, rotate the worst offenders, and report coverage to the board."
  },
  {
   "type": "p",
   "html": "Every step is worthwhile. At the end, the organisation knows what exists and has reduced credential age. What it still cannot do is answer the question that every incident starts with: <em>who is accountable for this identity?</em>"
  },
  {
   "type": "blockquote",
   "text": "An inventory tells you what exists. It does not tell you who should be answering the phone about it."
  },
  {
   "type": "h2",
   "text": "Populated is not accountable"
  },
  {
   "type": "p",
   "html": "NHI tooling reports owner-field coverage as a maturity metric. It is the wrong metric, and the substitution is worth making explicit."
  },
  {
   "type": "table",
   "head": [
    "Owner field content",
    "Counts as covered?",
    "Actually accountable?"
   ],
   "rows": [
    [
     "A team distribution list",
     "Yes",
     "No — no individual is answerable"
    ],
    [
     "A departed employee's name",
     "Yes",
     "No"
    ],
    [
     "The name of whoever ran discovery",
     "Yes",
     "No"
    ],
    [
     "A manager two reorganisations removed",
     "Yes",
     "Unlikely"
    ],
    [
     "A named engineer who created it and still owns it",
     "Yes",
     "<strong style=\"font-weight:600\">Yes</strong>"
    ]
   ]
  },
  {
   "type": "p",
   "html": "Four of five rows count as covered in a maturity report. One is evidence."
  },
  {
   "type": "h2",
   "text": "The Accountable Ownership Test"
  },
  {
   "type": "p",
   "html": "Five properties. Run it against a sample of fifty identities and count how many satisfy all five."
  },
  {
   "type": "ol",
   "items": [
    "<strong style=\"font-weight:600\">Named individual.</strong> The owner is a person, not a team, a queue or a system.",
    "<strong style=\"font-weight:600\">Affirmative act.</strong> The owner did something to become the owner — signed for it — rather than being assigned by a script.",
    "<strong style=\"font-weight:600\">Scope stated.</strong> The record says what the identity is authorised to do, not merely that it exists.",
    "<strong style=\"font-weight:600\">Expiry.</strong> The ownership lapses and must be renewed, so it decays visibly rather than silently.",
    "<strong style=\"font-weight:600\">Externally verifiable.</strong> Someone outside the platform — an auditor, an incident responder — can confirm it without trusting the platform's own database."
   ]
  },
  {
   "type": "p",
   "html": "Most estates satisfy the first property and none of the others. That is the finding worth taking to a steering committee, and it costs an afternoon to produce."
  },
  {
   "type": "h2",
   "text": "Why the owner field decays"
  },
  {
   "type": "p",
   "html": "Machine identities are created as a side effect of building systems. A pipeline needs a token, an integration needs a key, an agent needs a credential. Creation is an engineering act inside a platform, not an authorisation act by a principal."
  },
  {
   "type": "p",
   "html": "Ownership metadata is captured once, at creation, as free text. It then decays at the rate of organisational change — reorganisations, departures, team splits — which in most engineering organisations is faster than any rotation cycle."
  },
  {
   "type": "h2",
   "text": "The issuance receipt"
  },
  {
   "type": "p",
   "html": "The fix is to make creation an authorisation act."
  },
  {
   "type": "code",
   "text": "{\n  \"type\": \"manav-stmt/1\",\n  \"action\": \"machine_identity_issued\",\n  \"identity\": \"[principal identifier]\",\n  \"purpose\": \"[what it exists to do]\",\n  \"scope\": \"[permissions granted]\",\n  \"systems\": \"[what it can reach]\",\n  \"notAfter\": \"[expiry]\",\n  \"owner\": \"[named individual, credential assertion]\"\n}"
  },
  {
   "type": "p",
   "html": "Now ownership is an act with a signature and an expiry. When the owner leaves, their identities surface as a query rather than as an archaeology project, and the renewal cycle forces a periodic decision rather than permitting silent decay."
  },
  {
   "type": "h2",
   "text": "Where this connects to the breach data"
  },
  {
   "type": "p",
   "html": "Verizon's 2026 breach analysis attributed roughly 48% of breaches to third-party and supply chain paths. A substantial share of those paths run through machine identities — integration credentials, service accounts, tokens held by a vendor."
  },
  {
   "type": "p",
   "html": "An organisation that cannot name an accountable owner for those identities cannot make a decision about them quickly during an incident, which is when the decision matters."
  },
  {
   "type": "h2",
   "text": "The three-question test"
  },
  {
   "type": "table",
   "caption": "Run it on ten identities at random",
   "head": [
    "Question",
    "Pass condition"
   ],
   "rows": [
    [
     "Does the owner field name a person?",
     "Not a team, not a mailbox"
    ],
    [
     "Does that person still work here?",
     "Check the directory"
    ],
    [
     "<strong style=\"font-weight:600\">Can they say why it exists?</strong>",
     "<strong style=\"font-weight:600\">Without research</strong>"
    ]
   ]
  },
  {
   "type": "p",
   "html": "A programme that passes all three on ten random identities is in good shape. Most fail on the first, and almost all fail on the third — which is the one that matters, because an owner who cannot explain an identity cannot decide whether to remove it."
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Rotation is the priority.”</strong> Rotation improves hygiene and changes nothing about accountability. A rotated secret for an identity nobody can explain is a fresh secret for an unexplained identity."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Teams are the right owner for shared services.”</strong> Teams reorganise, and a team name in an owner field is a way of recording that nobody in particular is responsible. Name a person and let them delegate."
  }
 ],
 "faq": [
  {
   "q": "Which NHI ratio should we use?",
   "a": "Your own. Count the population you care about — identities with write access to production, for instance — and report it with the counting rule stated. Published ratios are not comparable to each other."
  },
  {
   "q": "Does this replace discovery tooling?",
   "a": "No. You cannot assign ownership to identities you have not found. Discovery is the prerequisite and this is the step after it."
  },
  {
   "q": "What about identities created by automation?",
   "a": "The automation runs under a delegation issued by a human, and identities it creates inherit that chain. The accountable human is the one who authorised the automation's scope."
  },
  {
   "q": "How long should ownership last before renewal?",
   "a": "Short enough that decay is caught — typically six to twelve months — and long enough that renewal does not become a rubber stamp, which is its own failure mode."
  },
  {
   "q": "What is the three-question test?",
   "a": "Does the owner field name a person, does that person still work here, and can they say why the identity exists without research."
  },
  {
   "q": "Why is rotation not enough?",
   "a": "It improves hygiene. A rotated secret for an identity nobody can explain is a fresh secret for an unexplained identity."
  },
  {
   "q": "Why not let teams own identities?",
   "a": "Teams reorganise. A team name in an owner field records that nobody in particular is responsible."
  }
 ],
 "sources": [
  {
   "t": "FCC — protecting consumers from SIM swap and port-out fraud",
   "u": "https://www.fcc.gov/sim-swap-port-out-fraud"
  },
  {
   "t": "Verizon Data Breach Investigations Report",
   "u": "https://www.verizon.com/business/resources/reports/dbir/"
  },
  {
   "t": "ISACA — identity and access management audit resources",
   "u": "https://www.isaca.org/resources"
  },
  {
   "t": "OWASP — Non-Human Identities Top 10",
   "u": "https://owasp.org/www-project-non-human-identities-top-10/"
  },
  {
   "t": "NIST SP 800-57 Part 1 Rev. 5 — key management",
   "u": "https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final"
  }
 ],
 "related": [
  {
   "slug": "creator-binding-offboarding",
   "title": "The engineer left; the integration did not",
   "category": "Developer"
  },
  {
   "slug": "revocation-latency-framework",
   "title": "Ninety-one percent of leaked secrets still work",
   "category": "Developer"
  },
  {
   "slug": "consent-reaffirmation",
   "title": "Third-party OAuth consent",
   "category": "Developer"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Accountable%20Ownership%20Test/1200_630/blog.jpg",
 "wordcount": 1088,
 "url": "/blog/accountable-ownership-test.html",
 "reading_time": "5 min read",
 "seo_title": "Eighty machine identities per human, none accountable",
 "meta_description": "Machine identity programmes end with a spreadsheet of thousands of identities whose owner field holds a team name, a leaver, or nothing.",
 "hub": {
  "slug": "topics/machine-identity",
  "title": "Machine and signing identity"
 },
 "answer": "Apply the test: pick one, find the owner field, and see whether it names a person who still works there and can say why it exists. Most non-human identity programmes end with a spreadsheet of thousands of identities whose owner field holds a team name, a departed employee, or nothing.",
 "answer_q": "Does any of your machine identities have a human behind it?",
 "glossary": [
  {
   "term": "Non-human identity",
   "def": "A service account, workload identity, API key or agent credential — outnumbering human identities by an order of magnitude."
  },
  {
   "term": "Accountable owner",
   "def": "A named person who can explain why an identity exists and decide whether it should continue."
  },
  {
   "term": "Orphaned identity",
   "def": "One whose owner has departed or whose purpose is unknown — the majority in most estates."
  }
 ],
 "checklist": {
  "title": "Establishing accountable ownership",
  "id": "ownership",
  "desc": "Four steps.",
  "steps": [
   {
    "name": "Run the three-question test on ten at random.",
    "text": "It takes an hour and sets the baseline."
   },
   {
    "name": "Require a named person, never a team.",
    "text": "With an explicit successor on departure."
   },
   {
    "name": "Require a stated purpose at creation.",
    "text": "Written by the creator, not inferred later."
   },
   {
    "name": "Expire identities without an accountable owner.",
    "text": "Rather than carrying them forward indefinitely."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav anchors every machine and agent identity to a named human through a signed delegation with scope, expiry and enforced revocation — so the chain from an action to a person survives the identity outliving its creator.",
  "href": "../docs.html",
  "label": "See delegation chains"
 }
}