Solutions

Fortified ID supports key parts of a non-human identity strategy across both Access and Control, although not in the same cloud-native model as platforms such as Microsoft Entra managed identities.

In Access, non-human identities can be handled through standards-based authentication and authorization for applications, APIs and service-to-service communication, using mechanisms such as OAuth 2.0, OpenID Connect and certificate-based trust. Access can therefore act as the authentication and trust layer for workloads, applications and other machine identities, even though it is not tied to a proprietary resource platform in the way managed identities are tied to Azure resources.

 

In Control, non-human identities can be governed in the same overall identity lifecycle model as human identities, with ownership, provisioning, delegated administration, approvals, auditability and access reviews. This makes it possible to manage service accounts, bots and AI agents as first-class identities rather than as hidden technical accounts.

 

A practical example is a personal AI agent assisting a case worker in Control. Such an agent should be treated as a separate non-human identity linked to a named user, with its own credentials, tightly scoped permissions, clear delegation rules and full audit logging. This preserves accountability while enabling automation.
PKI certificates are a strong fit for authenticating machine identities at runtime, while verifiable credentials can complement this by carrying portable, cryptographically verifiable claims about an application, system or agent across organizational boundaries.
In short, Access provides the authentication and trust layer for non-human identities, while Control provides the governance and lifecycle management layer.