NHI JIT

Just-in-time eligibility for non-human identities

Non-human identities accumulate standing secrets. Just-in-time eligibility issues short-lived AffixIO proofs at action time so workloads present signed allow or deny instead of long-lived keys for consequential operations.

Category AI agents Updated 17 July 2026 Reading ~6 min

NHIJITSHORT-LIVEDML-DSA-65ALLOW/DENYWORKLOADS

Agent authorisation Agent authorisation All trends

NHI just-in-time eligibility mints short-lived, policy-bound proofs for non-human identities immediately before a gated action.

Field note. Long-lived machine credentials survive breaches. JIT proofs limit blast radius to a single tool call or transaction.

JIT for consequential ops

Keep infrastructure identity where it belongs. For payments, data export, and privileged admin tools, issue AffixIO eligibility just in time. Verify before the action. Spend the proof if it must be single-use.

Coexists with SPIFFE and cloud workload identity. Different layer.

Rollout

Start with the highest blast-radius NHI. Measure secret reduction. Expand. Agent and automation platforms are natural fits.

See non-human identity and agent authorisation trends for adjacent reading.

Boundary hooks for NHI JIT eligibility

Map NHI JIT eligibility to a single verify endpoint even if multiple protocols feed the same checkout or tool surface. One permission layer reduces drift between AP2, UCP, and direct REST integrations.

Review deny rates weekly during pilot. Spikes often trace to policy drift or clock skew on expiry, not fraud.

QR offline gap

Standing privilege for machines

Bots and services often hold broad keys forever. That is convenient until compromise or audit day.

Secret eternity

Keys outlive the job.

Coarse scopes

One credential unlocks too many actions.

Poor forensics

Hard to show what a workload was allowed to do at a moment in time.

Integration model