Non-human identities now trigger incidents, deploy fixes, and access production faster than many engineers. This shift demands strict control over how these identities gain temporary, auditable access when systems break. The rules for on-call engineer access are no longer only about people. They must extend to automation, CI/CD bots, service accounts, and machine agents that operate around the clock.
Non-human identities often hold more privilege than any single engineer. They run migrations, connect to databases, and push code without direct supervision. But without proper guardrails, a compromised non-human identity can bypass security reviews, overwrite production data, and create outages at a scale no single person could achieve.
Managing on-call access for these identities is about balance: speed for urgent fixes, and strong security for everything else. Automated account credentials cannot live forever. Short-lived, just-in-time access for non-human identities is the safest pattern. Every session should be logged, tied to a specific event, and expire without manual cleanup.
Role-based policies must also adapt. Least privilege is not enough when roles are static. On-call access for non-human identities should activate only during triggers like error thresholds, alert correlations, or maintenance windows. Outside of those windows, the identity must be locked out. This reduces surface area and limits the blast radius of mistakes or attacks.