Two kinds of functionality
NHI inventory and ownership
The connector installs the source’s non-human accounts, the entitlements they hold and the resources they reach into Lumos, the way a standard connector installs users and groups. Every identity appears in one table with its source, type, last activity and status. You assign an owner and a business justification to each one, open an identity to see its accounts and entitlements, and search or filter across the whole inventory. Ownership set here follows the identity into agent findings, so a finding or a review is associated with a human instead of a blank field.NHI security analyst agents
An agent reads the connected environment and looks for the combination of factors that makes an identity exploitable, such as administrative privilege plus a credential that never expires plus no owner plus no recent activity. Over-privilege on its own is not a finding. The Identity Agent Force page contains all findings with a severity rating and the evidence behind it, plus a recommended next step. Findings that fail verification are dismissed before you see them. Agent reads don’t install anything in Lumos, so an integration used only by an agent has nothing to sync.
When a source supports both, one connection feeds both functionalities. When a source supports only the agent, you get findings without an inventory. When a source supports only the inventory, you get the registry and ownership without findings.
What every NHI integration has in common
Every NHI integration reads without writing. The inventory sync and the agents change nothing in the connected system, and Lumos doesn’t rotate credentials. It never reads secret values. In AWS, object, secret, parameter, row and log-content reads are blocked by an explicit Deny in the policy, and every call Lumos makes lands in your CloudTrail. In GitHub, Actions and webhook secrets are inventoried by presence and metadata only. Delete the AWS role and the next scan fails with AccessDenied, and Lumos shows a connection-lost banner on the integration.One service, two connectors The NHI integration is not the standard connector for the same service. The standard connector (Microsoft 365 / Entra ID or GitHub, for example) manages human accounts and entitlements. The NHI integration sits beside it with different permissions, and connecting one does not connect the other. Grant only the scopes its setup guide lists.