Non-human identities—service accounts, machine principals, build agents, CI/CD bots—are multiplying across environments. They hold keys to systems, access tokens, certificates, and API rights. At small scale, they are invisible but manageable. At large scale, they are everywhere, and every one of them can be a door for