Non-human identity

Definition

A non-human identity is any principal that is not a person at a keyboard: service-linked roles, assumed roles in CI pipelines, federated sessions minted by GetFederationToken, and agents holding temporary credentials. Authorisation systems evaluate them with the same procedure as human principals; what differs is the population’s shape - short-lived sessions, grants chosen in code, and review cadences that do not match grant cadences.

The problem

Sessions outnumber identities, and the principal making a request under an assumed role is the role session ARN, not the role ARN. A resource-based policy naming the session form bypasses ceilings that would have applied to the role form, so a population of short-lived sessions is systematically less constrained by boundaries than a population of users.

Why it matters

Most access in a modern account is machine access, and most of it is granted at session-mint time in code that no policy review reads. The interaction that decides effective permissions - which principal form the resource-based policy names - is chosen by whoever writes the assume-role call.

Practical example

A CI pipeline assumes a role and passes the session ARN to a downstream integration, which writes it into a bucket policy. The grant now bypasses the boundary attached to the role. No policy changed; the effective permissions did.

How RELIASTRA approaches it

RELIASTRA’s own checks are non-human callers of other companies’ control planes - scheduled workers rather than people - so the population this term describes is the population RELIASTRA adds to the internet, and the same principal-type rules apply to its credentials as to anyone else’s.