From nhi.sgit.ai, the page as fetched on 2026-09-24 · open the live page ↗Everything on this sheet is the source site's own text; the newsroom's chrome is outside it.

nhi.sgit.ai — non-human identity, blast radius and agentic security

The question "how do I give an identity to my agents?" splits into two populations — agents you run and agents you rent — and the industry only answers the first. For the agents people actually name (hosted coding assistants, chat interfaces, API-run agents) there is no way to issue a scoped, short-lived, attested identity today; the honest current practice is to hand over a broad credential and hope. This site publishes that thesis with evidence, a reproducible research method, dated option assessments, and a curated collection of the underlying corpus.

Site version: v0.1.19 (19 August 2026). Published by the sgit project — participant disclosure at /about/participant.html. All content CC BY 4.0.

The research

The thesis ↗: two populations, the evidence (open feature request, documented over-scope, Black Hat disclosure), why it is falsifiable and defensible.
The method ↗: one concrete scenario (four agents, four vaults, one repository, no shared access) answered per option in the same columns — privileges granted is the differentiating column; "works for rented agents" and "date verified" are the columns that make it worth doing.
Options ↗: assessments, currently preliminary (from cited sources, not yet re-run hands-on):
- SPIFFE / SPIRE, the open standard ↗ — strongest privileges story; requires infrastructure you control; multi-year cost.
- A commercial workload-identity broker ↗ — buys the engineering time back; still attests only workloads you run.
- Do nothing: broad credential + hope ↗ — the incumbent baseline, assessed honestly; the only option that works for rented agents, which is the thesis in one cell.

The thesis, tested

Shared drives for agents ↗: a second scenario fully scored (16 Aug 2026) — every available option runs on your identity so a rogue session reaches everything every other session can reach; the only granularity is segregation (a dedicated drive per agent), not scoping; nothing supports per-agent keys; no attribution at the agent level; curated memory destroys provenance by resolving conflicts on write. Source brief, verbatim with citations: https://nhi.sgit.ai/briefs/v0.33.59__research-brief__shared-drives-for-agents-identity-segregation-no-per-agent-keys.md ↗

Hope — concepts and workflows

Hope is not a control ↗: hope-driven development named; the two hopes (behaviour, discovery); the real authorization as the transitive closure of the grant; the expected-vs-unexpected delta; the two awareness gaps; and the ladder of workflows that replace hope — enumerate, map the closure, bound spend and time, observe independently, and issue no credential at all (the serialised pull request).

The industry map

Grouped by layer ↗: NHI discovery/posture/ governance (Astrix, Entro, Oasis, Token Security, Veza, SailPoint), workload IAM (Aembit), secrets & detection (HashiCorp Vault, CyberArk, Akeyless, GitGuardian), machine identity (Keyfactor, Venafi), and human-IAM platforms extending to agents (Microsoft Entra Agent ID, Okta). One profile page per provider, from published materials, dated 18 Aug 2026.
SPIFFE / SPIRE explained ↗: how attested workload identity works — SPIFFE IDs and SVIDs, the SPIRE issuance flow, federation — and why the mechanism is unavailable by construction for agents you rent.

The documents

The original briefs, readable in-page ↗: each with a summary, key concepts, key ideas, an infographic slot, and the full markdown rendered from the raw source under /briefs/. Eleven documents: the NHI site brief, the shared-drives research, the pki.sgit.ai brief, the serialised pull request, ambient authority/capability grants, the AOMM, the sandbox-escape incident analysis, who-can-pull-the-plug and the plug-profile probe, the catastrophic-risk board thesis, and the hope-driven authorization brief. Raw markdown for all of them under https://nhi.sgit.ai/briefs/ ↗ — the source of truth.

Dev packs

Packs hub ↗: implementation-plan packs authored by dev agents, captured verbatim with a reader page per document.
Static publishing pack ↗ (17–19 Aug 2026, build spec; captured at SGit-AI__CLI commit a7fb3f5): a vault publishes to a folder — ciphertext plus a declared plaintext surface — readable by a browser via a loader and by sgit clone over plain GETs from any static host, no server, no auth. Six invariants (byte-identical ciphertext everywhere; the key never reaches a server; keyless custody via mandatory manifest.json; byte-identical loader; plaintext only where the key is published; publishing never changes the vault), 14 test cells collapsed from 240 combinations, shippable phases, and measured evidence including: GitHub Pages sends access-control-allow-origin:* by default, and object ids hash ciphertext with random IVs so a fork is unlinkable. The 18–19 Aug revision added three documents from maintainer review: where a published folder may live (the publish-into-work-tree amplification loop, refused before a byte is written), published API docs (openapi.json generated from the manifest; Swagger UI CDN-pinned with SRI or bundled), and the first-party asset origin (publish-time source yes, read-time origin never — a zero-knowledge product cannot operate the beacon every reader pings). The 19 Aug revision then removed the publish target argument entirely (one fixed folder, .sg_vault/publish/, target-agnostic; deployment is a separate act) and added an EXECUTED tabletop exercise (https://nhi.sgit.ai/packs/static-publishing/tabletop-github-pages.html ↗): the agent ran the maintainer's scenario — one GitHub repo carrying the public read key, the decrypted files, and the encrypted vault store at once — with the real shipped CLI end to end, playing author/host/reader/archivist/CI-runner, simulating only the unbuilt publish command and GitHub's hosting. Measured results: publish → push is a no-op (the amplification loop is impossible by construction); the reader's static clone matches the author's tree; keyless custody verifies content-addressed objects with zero key material; a public vault's CI can republish with zero secrets from the committed read-key filename. Four live findings (F1–F4), including: a repo that commits the vault store is already statically clonable with shipped code — publish adds the browser, custody and key discovery, not clonability. The exercise then changed the spec it tested: r9 (decision 12) makes publish emit the plaintext surface ONLY — no ciphertext is ever copied, output is O(KB) for any vault, and the served root is composed at deployment (co-located, serving the repo itself with zero copies, or assembled by a keyless copy of bare/ into place; sgit vault serve composes virtually by routing). r10–r12 close a cross-session loop: a tabletop brief authored in the nhi.sgit.ai working session (https://nhi.sgit.ai/packs/static-publishing/pipelines-brief.html ↗) pre-registered two code-inspection findings — .sg_vault/backups/ zips can carry the vault key itself, so the canonical repo-side .gitignore is three lines (local/, backups/, .sg_vault_new/), and no shipped command binds a key to a fresh git checkout (now phase P9, sgit vault attach) — and a SECOND executed tabletop (https://nhi.sgit.ai/packs/static-publishing/tabletop-pipelines.html ↗) ran the full CI story in simulated-hosting mode: canonical gitignore proven by staging-then-excluding a keyed backup, zero-secret public pipeline, fork PRs skipping legibly, rollback as git revert (the site follows the repo timeline, not the vault's), and new findings F5 (a dead host reads as an empty vault — only a 404 means absent), F6 (attach must be mode-exclusive and schema-exact) and F7 (mis-ordered ref restore deploys a stale site). The publish folder's self-ignore is gone (r10) — it is what the Pages workflow deploys — and the canonical workflow lives as a committed template (https://nhi.sgit.ai/packs/static-publishing/src/templates/github-pages.yml ↗). Fifteen maintainer decisions. The pack keeps its own change-control log (https://nhi.sgit.ai/packs/static-publishing/changelog.html ↗): r0–r12, newest first, every revision with its trigger and the decisions it moved. Raw sources under https://nhi.sgit.ai/packs/static-publishing/src/ ↗
The fractal forge pack ↗ (18 Aug 2026, design pack; captured at SGit-AI__CLI commit fbebe0c): hub.sgit.ai as a forge whose application layer is the browser — the client holds the key, the server stores ciphertext and reads nothing. A hub is itself a vault (cover + catalogue + loader), so hubs can list hubs and the network is fractal by composition, with no federation protocol. Two findings about the shipped CLI open the pack: the sub-vault primitive every brief builds permissions on does not exist, and a third access tier — the structure key, which decrypts a vault's shape but not its content — is shipped, tested and unused. Also: permissions as key topology (four one-way-derived positions), commercialisation when you cannot read ("we cannot sell you privacy, because you already have it"), and the four stated absences including CI, whose model-consistent answer is a scoped key. Raw sources under https://nhi.sgit.ai/packs/hub-sgit-ai/src/ ↗

PKI — now its own site: pki.sgit.ai

The cryptographic half of the identity gap has spun out to https://pki.sgit.ai ↗ (live 19 Aug 2026): the 2019 keyserver failure, the four registry rules, identity vs. mandate, and the build roadmap all live there now — see https://pki.sgit.ai/llms.txt ↗. What remains here:

PKI bridge page ↗: the NHI framing — per-agent keys in a registry are what would fill the shared-drives research's three empty rows (no per-agent identity, no agent-level attribution, no encryption to a specific agent) — plus the link map to pki.sgit.ai. The old in-depth pages here forward to their pki.sgit.ai versions.
The scoping brief's document page ↗: the pki.sgit.ai strategy brief (v0.33.59, 16 Aug 2026) stays captured in this site's corpus; raw markdown at https://nhi.sgit.ai/briefs/v0.33.59__strategy-brief__pki-sgit-keyserver-failure-append-only-ownership-rule.md ↗

The collection

Organised by question ↗: what is an agent allowed to do; what happens when one is compromised; how do you bound spend and time; who can pull the plug; could your agents reach someone else; how do you attribute an action. Sources link to the open corpus repository (SGraph-AI__App__Send, CC BY 4.0).
The Agentic Outbound Maturity Model ↗: the five preconditions (capability, motive, reach, freedom, silence) and the conjunctive ladder (Unaware, Enumerated, Bounded, Observed, Contained, Accountable); the lethal trifecta corrected for the outbound case; budget and elapsed time as containment controls.
Infographics ↗: request list — awaiting LinkedIn post links from the project lead.