Defensible Identity Architecture: Nobody Authorised the Machine

Your enterprise is now run by machine identities no board can name. Service accounts, API keys, and autonomous AI agents outnumber your people forty to one — and they act without a human in the loop. When one moves money, exposes data, or breaches a client, the regulator asks a single question: who authorised this? Under NIS2 and DORA, "we did not know the system would do that" is no longer a defence — it is a personal liability that lands on the management body. The human perimeter has fallen, and authority now drains into a Delegation Void: the gap where a machine acts with real-world consequence and no named human can be found to own it. Defensible Identity Architecture is the board-level operating model for governing the non-human enterprise. It puts a named human behind every machine that acts, an architecture that proves it after the fact, and a commercial edge that turns control into won contracts. Built on a coherent, verifiable doctrine — the Machine Accountability Doctrine™, Decision Rights Architecture™, and the Access Evidence Chain™ — it shows you how to: • WIN regulated, high-value contracts on the strength of your security annexe. • AVOID director liability under NIS2 Article 20 and the voiding of cyber-insurance cover. • PROVE every consequential machine action back to a named, accountable owner. This is a working manual, not a thesis. Eleven board-ready diagrams, a five-level maturity model, a quantified (FAIR-aligned) risk method, a procurement clause library, a regulatory crosswalk across DORA, NIS2 and the EU AI Act, and a 24-month roadmap make it a reference you will return to every week. Essential reading for CISOs, identity and AI-governance leaders, security architects, risk-committee chairs, and procurement and supplier-risk teams across financial services and every regulated enterprise preparing for the 2030 regulatory horizon. "If it cannot be evidenced, it cannot be defended."