A 5-15 person team running AI tools on paid client work in 2026 can move from default-shared personal credentials for AI agents to a defensible non-human-identity posture in three hours of work using existing tooling (password manager, calendar, spreadsheet). The five-step starter kit (inventory every AI tool acting in the environment and its credential; mint per-agent credentials with smallest-scope; move every credential into one secrets vault and remove from elsewhere; set a 90-day rotation cadence with a calendar owner; write and test a one-page leaver and revocation runbook) covers the credential-management practices that CyberArk-grade enterprise NHI programmes cover, scaled to a team without an identity-governance function. The answer the kit produces is sufficient for almost every mid-market and SMB client procurement question, and a credible answer to most enterprise procurement questionnaires reaching small-agency vendors in 2026.

Claim is scoped to the operational capability of a 5-15 person services team to reach a defensible NHI posture using existing tools. Does not assert the kit replaces enterprise-grade IAM tooling for the team's own internal systems if the team grows past ~20 people or starts holding regulated client data classes (HIPAA, PCI). 30-day review cadence aggressive because the small-team SaaS pricing and feature landscape moves fast and one vendor change can render a kit step easier or harder. Trigger conditions: (1) a major SMB-targeted vault product (1Password, Bitwarden, Doppler) ships agent-credential-management as a default feature with rotation reminders and audit-log export — would move toward Partial because the tooling gap is closing; (2) a published small-business or small-agency breach traceable to a shared AI tool credential — would confirm the structural exposure and strengthen the case-for-action; (3) a published change in small-business cyber insurance terms requiring NHI controls — would change the operator's incentive map and the kit becomes table-stakes rather than discretionary; (4) an enterprise procurement-questionnaire standard (ISA, SIG Lite, CAIQ) adds explicit NHI questions for small-vendor responses — would change the procurement-cycle pressure on small agencies.