Low-Code AI Agent Security: Governing Citizen Agents

Low-code and no-code agent platforms let business users build AI agents in minutes: an agent that answers HR questions, triages support tickets, updates CRM records or processes invoices. These platforms are built into productivity suites, CRM, IT service management and automation tools, and they connect to business systems through prebuilt connectors. That makes them powerful and popular, and it means thousands of agents can appear with connections to sensitive data, running under their creators' credentials or shared connection accounts, with little security review. This guide explains the identity risks of citizen-built agents and how to govern them without stopping innovation.

Key takeaways

Citizen-built agents inherit the connectors and credentials their makers choose, often the maker's own account or a shared connection with broad access.
Key risks are over-privileged connections, oversharing of agents, data leakage through connectors, prompt injection and token theft.
Govern through the platform: environments, connector policies, sharing limits, authentication requirements and inventory.
Treat every production agent as a registered NHI with an owner.

How low-code agents get access

Maker's credentials: the agent's connections run as the person who built it, so every user of the agent acts with the maker's access.
Shared connection accounts: a service or integration account configured once and used by many agents.
End-user delegated access: each user signs in and the agent acts with their own permissions. This is usually the safest option for user-facing agents.
Custom connectors and HTTP actions calling APIs with keys stored in the platform.

The first two patterns effectively give every user of the agent someone else's access, which breaks least privilege and attribution.

The risks

Privilege by proxy: an agent built by an HR administrator and shared broadly lets any user query HR data through the administrator's connection.
Oversharing: agents shared with the whole organisation or published externally without authentication.
Data exfiltration through connectors: agents that read internal data and can send it to external services, email or public endpoints.
Prompt injection: agents processing inbound email, forms or web content can be steered.
Token theft and consent abuse: the CoPhish campaign used Copilot Studio agents to trick users into granting OAuth tokens.
Orphaned agents: makers leave or move, and their agents continue running with their connections.
Secrets in configuration: API keys pasted into custom actions.

Governance controls

Platform configuration

Separate environments for experimentation and production, with stricter policies in production.
Connector policies that block high-risk connectors and prevent combining sensitive internal connectors with external ones in the same agent.
Require authentication for published agents; restrict anonymous and external publishing.
Limit sharing scope by default (for example, to a team) and require approval for organisation-wide sharing.

Identity

Prefer end-user delegated authentication for agents that access user data.
Where a shared connection is needed, use a dedicated, least-privilege service identity per agent, not a maker's personal account.
Store secrets in the platform's secure store or an external secrets manager, never in plain configuration.
See the Agentic AI Identity Guide.

Lifecycle

Register production agents with an owner, purpose, connectors and data classification.
Review agents periodically; disable those without owners or activity.
Reassign or disable agents when makers leave. See the Joiner-Mover-Leaver Guide.

Monitoring

Inventory all agents across environments using platform admin tools. See the Shadow AI Discovery Guide.
Monitor agent activity, connector use and data volumes; alert on new external connections and sharing changes.

Enabling makers safely

Publish approved templates and connection patterns.
Offer a lightweight review for agents moving to production, focused on identity, data and sharing.
Train makers on least privilege, prompt injection and data handling.

Practitioner checklist

Inventory agents in every low-code platform, with owners, connectors and sharing.
Separate experimentation and production environments.
Enforce connector policies and block risky connector combinations.
Prefer end-user authentication; replace maker-credential connections.
Restrict sharing and anonymous publishing.
Require owners, review production agents and clean up orphans.
Monitor activity and sharing changes.

Standards and references

OWASP Low-Code/No-Code Top 10
OWASP Top 10 for Agentic Applications for 2026: ASI02, ASI03
OWASP Non-Human Identities Top 10 (2025): NHI10 Human Use of NHI, NHI5

Low-Code Agent Platform Security Guide