Governance of non-human identity
Machines, services, vendor integrations and now AI agents. They act continuously, hold standing authority, and sit outside the controls built for employees. X2A governs what your identity programme was never designed to see.
Secure innovation. Accountable adoption.
Identity register · Entry 0417
Reading…
Domain 01
Your organisation is already running AI — in tooling you selected and in services your suppliers changed without telling you. X2A establishes what is running, on whose data, under whose authority, and what those systems can reach.
Read the AI positionDomain 02
Service accounts, API keys and integrations are created by whoever needed them and have no equivalent of leaving. X2A brings that population inside ownership, lifecycle, recertification and segregation of duties.
Read the identity positionAn AI agent is a non-human identity with initiative.
AI governance asks who decided. Only identity governance can answer. Every requirement to explain, contest or attribute an automated decision resolves, eventually, to a question about identity.
Where we begin
X2A engages through fixed-scope, fixed-fee assessments. Scope, duration and price are agreed before work begins, and the deliverable is a document a risk committee can act on — findings, ownership gaps, and a sequence of remediation with a named owner against each item.
Assessments are read-only. No agents are installed, no configuration is changed, and nothing is introduced into a production path. We work from exports, configuration and interviews.
Our position
Access governance was built around employment. The fastest-growing population inside a regulated institution was never employed.
Continue readingEvery obligation to explain an automated decision terminates in a question about identity. Most institutions cannot answer it.
Continue readingMigration timelines are being discussed before institutions know where their keys are, what issued them, and which machine identities depend on them.
Continue reading