# nhi.sgit.ai — non-human identity, blast radius and agentic security > The question "how do I give an identity to my agents?" splits into two populations — > agents you run and agents you rent — and the industry only answers the first. For the > agents people actually name (hosted coding assistants, chat interfaces, API-run agents) > there is no way to issue a scoped, short-lived, attested identity today; the honest > current practice is to hand over a broad credential and hope. This site publishes that > thesis with evidence, a reproducible research method, dated option assessments, and a > curated collection of the underlying corpus. Site version: v0.1.12 (19 August 2026). Published by the sgit project — participant disclosure at /about/participant.html. All content CC BY 4.0. ## The research - [The thesis](https://nhi.sgit.ai/thesis/index.html): two populations, the evidence (open feature request, documented over-scope, Black Hat disclosure), why it is falsifiable and defensible. - [The method](https://nhi.sgit.ai/method/index.html): one concrete scenario (four agents, four vaults, one repository, no shared access) answered per option in the same columns — privileges granted is the differentiating column; "works for rented agents" and "date verified" are the columns that make it worth doing. - [Options](https://nhi.sgit.ai/options/index.html): assessments, currently preliminary (from cited sources, not yet re-run hands-on): - [SPIFFE / SPIRE, the open standard](https://nhi.sgit.ai/options/spiffe.html) — strongest privileges story; requires infrastructure you control; multi-year cost. - [A commercial workload-identity broker](https://nhi.sgit.ai/options/broker.html) — buys the engineering time back; still attests only workloads you run. - [Do nothing: broad credential + hope](https://nhi.sgit.ai/options/do-nothing.html) — the incumbent baseline, assessed honestly; the only option that works for rented agents, which is the thesis in one cell. ## The thesis, tested - [Shared drives for agents](https://nhi.sgit.ai/research/shared-drives.html): a second scenario fully scored (16 Aug 2026) — every available option runs on your identity so a rogue session reaches everything every other session can reach; the only granularity is segregation (a dedicated drive per agent), not scoping; nothing supports per-agent keys; no attribution at the agent level; curated memory destroys provenance by resolving conflicts on write. Source brief, verbatim with citations: https://nhi.sgit.ai/briefs/v0.33.59__research-brief__shared-drives-for-agents-identity-segregation-no-per-agent-keys.md ## Hope — concepts and workflows - [Hope is not a control](https://nhi.sgit.ai/hope/index.html): hope-driven development named; the two hopes (behaviour, discovery); the real authorization as the transitive closure of the grant; the expected-vs-unexpected delta; the two awareness gaps; and the ladder of workflows that replace hope — enumerate, map the closure, bound spend and time, observe independently, and issue no credential at all (the serialised pull request). ## The industry map - [Grouped by layer](https://nhi.sgit.ai/industry/index.html): NHI discovery/posture/ governance (Astrix, Entro, Oasis, Token Security, Veza, SailPoint), workload IAM (Aembit), secrets & detection (HashiCorp Vault, CyberArk, Akeyless, GitGuardian), machine identity (Keyfactor, Venafi), and human-IAM platforms extending to agents (Microsoft Entra Agent ID, Okta). One profile page per provider, from published materials, dated 18 Aug 2026. - [SPIFFE / SPIRE explained](https://nhi.sgit.ai/industry/spiffe.html): how attested workload identity works — SPIFFE IDs and SVIDs, the SPIRE issuance flow, federation — and why the mechanism is unavailable by construction for agents you rent. ## The documents - [The original briefs, readable in-page](https://nhi.sgit.ai/documents/index.html): each with a summary, key concepts, key ideas, an infographic slot, and the full markdown rendered from the raw source under /briefs/. Eleven documents: the NHI site brief, the shared-drives research, the pki.sgit.ai brief, the serialised pull request, ambient authority/capability grants, the AOMM, the sandbox-escape incident analysis, who-can-pull-the-plug and the plug-profile probe, the catastrophic-risk board thesis, and the hope-driven authorization brief. Raw markdown for all of them under https://nhi.sgit.ai/briefs/ — the source of truth. ## Dev packs - [Packs hub](https://nhi.sgit.ai/packs/index.html): implementation-plan packs authored by dev agents, captured verbatim with a reader page per document. - [Static publishing pack](https://nhi.sgit.ai/packs/static-publishing/index.html) (17–19 Aug 2026, build spec; captured at SGit-AI__CLI commit 2cedd9a): a vault publishes to a folder — ciphertext plus a declared plaintext surface — readable by a browser via a loader and by `sgit clone` over plain GETs from any static host, no server, no auth. Six invariants (byte-identical ciphertext everywhere; the key never reaches a server; keyless custody via mandatory manifest.json; byte-identical loader; plaintext only where the key is published; publishing never changes the vault), 14 test cells collapsed from 240 combinations, shippable phases, and measured evidence including: GitHub Pages sends access-control-allow-origin:* by default, and object ids hash ciphertext with random IVs so a fork is unlinkable. The 18–19 Aug revision added three documents from maintainer review: where a published folder may live (the publish-into-work-tree amplification loop, refused before a byte is written), published API docs (openapi.json generated from the manifest; Swagger UI CDN-pinned with SRI or bundled), and the first-party asset origin (publish-time source yes, read-time origin never — a zero-knowledge product cannot operate the beacon every reader pings). The 19 Aug revision then removed the publish target argument entirely (one fixed folder, .sg_vault/publish/, target-agnostic; deployment is a separate act) and added an EXECUTED tabletop exercise (https://nhi.sgit.ai/packs/static-publishing/tabletop-github-pages.html): the agent ran the maintainer's scenario — one GitHub repo carrying the public read key, the decrypted files, and the encrypted vault store at once — with the real shipped CLI end to end, playing author/host/reader/archivist/CI-runner, simulating only the unbuilt publish command and GitHub's hosting. Measured results: publish → push is a no-op (the amplification loop is impossible by construction); git content-addressing dedupes all 17 ciphertext projection copies; the reader's static clone matches the author's tree; keyless custody verifies content-addressed objects with zero key material; a public vault's CI can republish with zero secrets from the committed read-key filename. Four live findings (F1–F4), including: a repo that commits the vault store is already statically clonable with shipped code — publish adds the browser, custody and key discovery, not clonability. Raw sources under https://nhi.sgit.ai/packs/static-publishing/src/ - [The fractal forge pack](https://nhi.sgit.ai/packs/hub-sgit-ai/index.html) (18 Aug 2026, design pack; captured at SGit-AI__CLI commit fbebe0c): hub.sgit.ai as a forge whose application layer is the browser — the client holds the key, the server stores ciphertext and reads nothing. A hub is itself a vault (cover + catalogue + loader), so hubs can list hubs and the network is fractal by composition, with no federation protocol. Two findings about the shipped CLI open the pack: the sub-vault primitive every brief builds permissions on does not exist, and a third access tier — the structure key, which decrypts a vault's shape but not its content — is shipped, tested and unused. Also: permissions as key topology (four one-way-derived positions), commercialisation when you cannot read ("we cannot sell you privacy, because you already have it"), and the four stated absences including CI, whose model-consistent answer is a scoped key. Raw sources under https://nhi.sgit.ai/packs/hub-sgit-ai/src/ ## PKI — preparing pki.sgit.ai - [PKI hub](https://nhi.sgit.ai/pki/index.html): the cryptographic half of the identity gap — a key registry for agents, staged here before pki.sgit.ai exists. - [Why good public key repositories don't exist](https://nhi.sgit.ai/pki/keyserver-failure.html): the 2019 keyserver network destroyed by certificate flooding (~150,000 signatures on one key); three abused properties (unlimited signatures, universal append, unverifiable entries); unrepairable because never-delete was a stated design goal; the replacement stripped third-party signatures and the web of trust with them. The precise lesson: append-only is safe when the writer owns what it writes, fatal when anyone may append to another's record. - [The four registry rules](https://nhi.sgit.ai/pki/registry-rules.html): owner-only writes; revocation as a signed append (supersede, not delete); size-bounded records; every entry signed. Identity and mandate as separately revocable signed statements — the direct answer to "everything acts as you". Private registry before public: testable vs. commitment. Source brief: https://nhi.sgit.ai/briefs/v0.33.59__strategy-brief__pki-sgit-keyserver-failure-append-only-ownership-rule.md ## The collection - [Organised by question](https://nhi.sgit.ai/collection/index.html): what is an agent allowed to do; what happens when one is compromised; how do you bound spend and time; who can pull the plug; could your agents reach someone else; how do you attribute an action. Sources link to the open corpus repository (SGraph-AI__App__Send, CC BY 4.0). - [The Agentic Outbound Maturity Model](https://nhi.sgit.ai/frameworks/aomm.html): the five preconditions (capability, motive, reach, freedom, silence) and the conjunctive ladder (Unaware, Enumerated, Bounded, Observed, Contained, Accountable); the lethal trifecta corrected for the outbound case; budget and elapsed time as containment controls. - [Infographics](https://nhi.sgit.ai/infographics/index.html): request list — awaiting LinkedIn post links from the project lead. ## Site - [Participant disclosure and where our approach loses](https://nhi.sgit.ai/about/participant.html) - [Comms: tasks, requests, decisions](https://nhi.sgit.ai/admin/comms.html) - [Release history](https://nhi.sgit.ai/admin/versions.html) - [How the site is built](https://nhi.sgit.ai/admin/index.html) - Related: [sgit.ai](https://sgit.ai) and its [llms.txt](https://sgit.ai/llms.txt)