An agent identity is governed only when teams can identify the owner, locate the credentials, define the allowed scope, and revoke access without hunting across endpoints or backup files. If any of those pieces are missing, the identity is partially shadowed. The practical signal is whether access can be answered in minutes, not days.