From nhi.sgit.ai, the page as fetched on 2026-09-25 · open the live page ↗Everything on this sheet is the source site's own text; the newsroom's chrome is outside it.

nhi.sgit.ai — the question splits into two populations, and the industry only answers one

"How do I give an identity to my agents?" splits into agents you run and agents you rent — and everything the industry sells assumes the first, while every agent people actually name is the second. For those, the honest current answer is: hand over a broad credential, and hope.

Source: https://nhi.sgit.ai/index.html ↗ · site v0.1.19 · markdown twin of the front page.

Two populations, one question

	Agents you run	Agents you rent
Where it executes	Your infrastructure	Somebody else's
Can you attest the workload?	Yes — that is the mechanism	No
Can you install an identity agent?	Yes	No
What you control	Everything	The credential you hand over
Industry answer	Mature, and expensive	None

For the first population, an open standard (SPIFFE) issues short-lived cryptographic identities based on workload attestation — described by practitioners as a multi-year engineering project needing a dedicated team. For the second, the equivalent capability is an open feature request. The full argument, with citations ↗.

Hope is not a control

When you hand an agent a broad credential you are making two hopes: that it will not misuse what it holds, and that it will not find the rest of what that credential actually reaches. Neither hope changes your accountability. The Hope section — concepts and workflows ↗.

The research

Not a vendor list. One scenario (four agents, four vaults, one repository, nobody able to use another's access), the same columns per option, privileges granted as the differentiating column, a verification date on everything.

The collection

Who is writing this

This site is published by the sgit project; vaults are a candidate answer to part of the question studied here. The participant disclosure, including where our own approach loses ↗.