---
title: Discover and manage NHI agents
description: AI Discovery for NHI agents finds non-human identity agents operating in your environment and helps you govern them.
component: privilege
page_id: privilege:agent-privilege:use-cases/nhi-agents
canonical_url: https://docs.pingidentity.com/privilege/agent-privilege/use-cases/nhi-agents.html
llms_txt: https://docs.pingidentity.com/privilege/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: October 21, 2026
page_aliases: ["agent-privilege:use-cases/ai-discovery-nhi-agents.adoc"]
section_ids:
  how-the-pieces-fit-together: How the pieces fit together
  before-you-begin: Before you begin
  nhi-agents-discovery: NHI agents discovery
  creating-a-node-policy: Creating a node policy
  result: Result:
  managing-node-policies: Managing node policies
---

# Discover and manage NHI agents

AI discovery for non-human identity (NHI) agents finds the AI workloads running in your containers and helps you govern them. The PingOne Privilege node sensor observes these workloads, and PingOne Privilege both inventories them and enforces policy on them.

Discovery does not require every AI workload to be registered as an NHI before the sensor can find it. The sensor identity must be registered so the sensor can authenticate to PingOne Privilege. Register a workload identity separately when you need to associate the workload with that identity or match it in identity-based policy. Learn more in [Registering non-human identities](../configuration/non-human-identities.html).

## How the pieces fit together

The workflow is:

1. Register a non-human identity for the sensor itself. Learn more in [Registering non-human identities](../configuration/non-human-identities.html).

2. Deploy the sensor on your Kubernetes *(tooltip: \<div class="paragraph">
   \<p>An open-source system for automating deployment and management of containerized applications.\</p>
   \</div>)* clusters or Docker hosts. Learn more in [Deploying the node sensor](../configuration/node-sensor.html).

3. Review the discovery findings on the **NHI Agents** dashboard.

4. Configure NHI agent policy for the sensor to enforce.

## Before you begin

To discover and manage NHI agents, ensure you have the following:

* A non-human identity registered in PingOne Privilege for the sensor, so the sensor can authenticate its reports. Learn more in [Registering non-human identities](../configuration/non-human-identities.html).

* The node sensor deployed on your Kubernetes *(tooltip: \<div class="paragraph">
  \<p>An open-source system for automating deployment and management of containerized applications.\</p>
  \</div>)* clusters or Docker hosts. Learn more in [Deploying the node sensor](../configuration/node-sensor.html).

* For identity-based policy, the non-human identities your agents use registered in the directory. Learn more in [Registering non-human identities](../configuration/non-human-identities.html).

## NHI agents discovery

![The NHI Agents dashboard showing identities, workloads, agents, LLMs, and MCPs count tiles, the AI types breakdown, and the top workloads list.](../_images/p1p_nhi_agents_dashboard.png)

To review what discovery finds for NHI agents:

1. In the PingOne Privilege admin console, go to **AI Security > NHI Agents**.

   Your **NHI Agents** dashboard provides an overview of the agents operating under non-human identities in your environment.

2. Review the overview. The dashboard shows the following:

   * What discovery found, including:

     * The number of registered identities reporting

     * The workloads observed

     * The agents, LLMs, and MCP servers discovered

   * The time of the most recent detection and the sensor instance that produced it.

   * The share of each AI type among the findings, and the workloads with the most findings.

3. Explore the other tabs in the dashboard:

   * The **Identities** tab displays the non-human identities registered in PingOne Privilege.

   * The **Agents**, **LLMs**, and **MCPs** tabs show what has been discovered for each kind of workload. Each finding gives the classification of the workload and attributes it to the pod or container that produced it:

     * AI agents and agent frameworks observed running in your containers.

     * MCP servers, detected from process execution and the port the process listens on.

     * Self-hosted model servers listening on inference ports.

     * The model endpoints each workload calls, identified from the unencrypted handshake. No TLS is terminated and no traffic is decrypted.

   * The **Policies** tab lists the policies you configured.

4. Investigate findings to decide what remediation actions to take.

## Creating a node policy

Create policies to govern the AI workloads in the **Policies** tab on the **NHI Agents** page.

|   |                                                                                                                                                                                                                                   |
| - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | You can also create policies for specific NHI agents found in the **Agents**, **LLMs**, and **MCPs** tabs. Creating a policy for an agent in the list populates the fields specific to the agent you're configuring a policy for. |

1. In the PingOne Privilege admin console, go to **AI Security > NHI Agents**.

2. Click the **Policies** tab.

3. Click **Create Node Policy**.

4. Enter a **Name** and **Description** for the policy.

5. Select the entities the policy applies to:

   * **Agents**

   * **Local models**

   * **MCP servers**

     |   |                                                            |
     | - | ---------------------------------------------------------- |
     |   | If you don't select any, the policy applies to every kind. |

6. Click **Next**.

7. Create one or more **Matches** for the policy to apply to:

   * **Name**: Process name on execution. An interpreted agent is named by its script and interpreter.

   * **Process path**: Full path of the binary, which is never truncated. Select this option when several programs share one process name.

   * **Host**: Where the workload connects to, read from the TLS handshake.

   * **Tool**: A tool an MCP server advertises when probed.

   * **Identity key**: What the software was identified as, whatever the process is called.

8. Click **Next**.

9. Configure the identities for the policy:

   1. In the **Token issuer type** list, select the platform the policy is for.

   2. In the **Non-human identities** list, select the hosts the policy reaches through those identities. Leave empty to deliver this policy to every reporting identity.

10. Review the **Summary** for the policy.

11. In the **Namespace** list, select an option for which namespaces the policy applies to:

    * **All namespaces**: The policy reaches every node and matches nothing.

    * **Named namespaces**: A node checks the namespace before acting. Enter the specific Kubernetes namespaces in the text field.

12. Select an action for the policy:

    * **Monitor**: Reports the process and doesn't take any action.

    * **Allow**: Exempts it from a broader deny.

    * **Warn**: Reports a warning, but the process still runs.

    * **Deny**: Terminates the process when it starts.

13. For policy state, you can either:

    * Leave the policy **Enabled** by default, which enacts the policy when it's created.

    * Toggle the policy to **Disabled**. The policy appears in the list of policies, but delivers no actions to nodes.

14. Click **Create Policy**.

    ### Result:

    The policy appears in the list of policies.

### Managing node policies

1. In the PingOne Privilege admin console, go to **AI Security > NHI Agents**.

2. Click the **Policies** tab.

3. In the list, find the node policy you want to manage.

4. (Optional) From the list, you can either:

   * Click **Edit** to view and change any of the node policy configuration fields.

   * Click **Delete** to delete the policy.