--- title: "Scalable NHI permission management" description: "Authorization for non-human identities — workloads, microservices, AI agents and API clients — with policy-driven access control across the whole architecture." canonical: "https://www.cerbos.dev/features-benefits-and-use-cases/authorization-non-human-identities" source: "https://www.cerbos.dev/features-benefits-and-use-cases/authorization-non-human-identities" --- # Scalable NHI permission management Secure every workload, microservice, AI agent, and API client in your architecture with policy-driven authorization ## Non-human identities are your hidden security risk - **The fastest-growing attack surface** — NHIs are fragmented, overprivileged, and invisible. Every workload becomes a backdoor for attackers. - **Compliance startswith machines** — Compliance requires auditable and enforceable access controls for both humans and machines. - **Overprivileged NHIs break Zero Trust** — Zero Trust model requires every request to be checked in every service. Blindly trusting microservices breaks this paradigm. - **AI multipliesNHI risk** — AI agents with no authorization controls expand the attack surface and increase the risk of data leaks. ## NHI permission management with Cerbos A centralized, scalable solution to implement consistent authorization policies for every identity across the entire architecture - **Issue identity** — Leverage an IdP to issue every workload a unique identity - **Set policies** — Set your user and service-level access policies - **Request access** — Cerbos evaluates each service request against policy and allows or denies access - **Audit** — Every request is captured along with the access decision and the policy that enforced it ## Manage access for every identity, human or machine - Workforce - Partners - Customers - Microservices - Workloads - API clients - AI agents - AI workflows - MCP servers ## Our approach to future-proof authorization ### Build your Workload IAM strategy Define, manage, and enforce access policies for all identity types: - Powerful ABAC, RBAC, and PBAC for your NHIs. - Full control over NHIs in cloud, on-prem, or hybrid environments. - Support Zero Trust with least privilege and continuous verification for every machine identity. - Seamless scalability and flexible run-time authorization. [Let's discuss your NHIs strategy](https://www.cerbos.dev/workshop) ### Handle authorization at the API gateway, in the service mesh, and microservices Prevent over-permissioned services with policy-based authorization, one policy engine for both user and service identities. - Enforce least privilege access control among services. - Secure service-to-service communication using NHIs tied to each microservice. - Implement a principal identity-based delegated authorization strategy. - Apply consistent authorization across cloud-native, containerized, and distributed environments. - Predictable performance at scale driven by the stateless architecture. [Talk to an engineer](https://www.cerbos.dev/workshop) ### Safeguard AI agents, MCP servers, and RAG AI agents are non-human identities that access systems autonomously, govern their action,s and control data access to prevent leakage, injection, and overreach. - Secure agentic workflows with centralized policies. - Dynamic, policy-driven prompt filtering to add additional layers of control. - Control what context an LLM is provided with permission-aware data filtering for vector stores. - Enhance RAG architectures using data restricted to the user's permissions. [Talk to an engineer](https://www.cerbos.dev/workshop) ### Get full visibility into NHI actions Centralized audit trails for all non-human identity access decisions across all your applications. Stay compliant with SOC2, ISO27001, HIPAA, PCI/DSS, and GDPR. - Capture every authorization check—across services, agents, and APIs—with structured logs that enable full traceability, compliance readiness, and forensic investigations. - Track which AI agent, API client, or workload accessed what, when, on behalf of whom, and which policy granted access, ensuring no identity operates unchecked. - Remove NHI compliance risks with full visibility into your workload’s actions [Talk to an engineer](https://www.cerbos.dev/workshop) ## Seamlessly fit into your tech stack - Machine identity providers - SDKs - Deployment models ## Why enterprises choose Cerbos - **Centralized policy management** — Unify your authorization strategy for all identity types in a central hub. - **Authorize anywhere** — Run your authorization logic anywhere, in your infrastructure or at the edge. - **Grows with your architecture** — Support evolving org structures, NHI growth, and complex access models. - **Full auditability** — Capture every request and decision in standardized audit logs. ## Learn more about NHIs - [Securing AI agents and non-human identities in enterprises](https://solutions.cerbos.dev/securing-ai-agents-non-human-identities-in-enterprises) — Ebook - **Fine-grained authorization for non-human identities** — Webinar - [Cerbos named a Sample Vendor for AuthZEN in the Gartner Hype Cycle for Digital Identity](https://www.cerbos.dev/blog/cerbos-named-sample-vendor-authzen-gartner-hype-cycle-for-digital-identity) — Announcement - [The ROI of NHI security](https://www.cerbos.dev/blog/roi-of-nhi-security-investing-in-machine-identity-protection-pays-off) — Article - [A CISO’s benchmark for authorization maturity](https://solutions.cerbos.dev/authorization-maturity-model-a-cisos-benchmark) — Ebook - [Dimmer switch: AI agent governance](https://www.cerbos.dev/blog/dimmer-switch-not-a-kill-switch-rethinking-ai-agent-governance) — Article - [SPIFFE identity parsing added to Cerbos PDP](https://www.cerbos.dev/blog/spiffe-identity-parsing-cerbos-pdp) — Guide - [How to implement Cerbos for authorization of NHIs](https://www.cerbos.dev/blog/cerbos-for-non-human-identities) — Article - [How Utility Warehouse secured millions of NHIs with Cerbos](https://www.cerbos.dev/customers/utility-warehouse/non-human-identities) — Success story - [Understanding and addressing the OWASP top 10 threats](https://www.cerbos.dev/blog/safeguarding-non-human-identities-understanding-and-addressing-owasp-top-10-threats) — Article - [Securing cloud architectures in the age of NHIs and ephemeral services](https://www.cerbos.dev/news/securing-cloud-architectures-non-human-identities-ephemeral-services) — Article - [NHI security: How to manage non-human identities and AI agents](https://www.cerbos.dev/blog/nhi-security-how-to-manage-non-human-identities-and-ai-agents) — Article - **Securing agentic AI in production** — Webinar - [NHI management still has a blind spot](https://www.cerbos.dev/blog/non-human-identity-management-has-a-blind-spot) — Article - [Multi-hop delegation for AI agents, explained](https://www.cerbos.dev/blog/multi-hop-delegation-ai-agents) — Article - [Best AI agent security and governance tools](https://www.cerbos.dev/blog/best-ai-agent-security-and-governance-tools) — Guide