Security teams should treat approved inventories as a starting point and query the environment directly. The goal is to reconcile embedded agents, user-activated agents, and internally built agents into one live register with ownership, access scope, and review status. If the inventory cannot be refreshed continuously, it is not a control.
Why This Matters for Security Teams
Approved inventories rarely capture the full agent footprint because agents appear in product defaults, user-triggered copilots, internal automations, and vendor-managed workflows. That creates a discovery problem as much as a governance problem: if security cannot see an agent, it cannot assess ownership, tool access, or data exposure. This is especially risky for agentic systems because an agent can chain tools, act outside a fixed schedule, and inherit privileges that were never reviewed as an identity.
Research on agentic risk has already shown how quickly hidden capability can become exploitable. NHIMG’s OWASP NHI Top 10 and the OWASP Agentic AI Top 10 both emphasise that governance failures often start with incomplete visibility, not with a single catastrophic misconfiguration. In practice, many security teams encounter shadow agents only after a support ticket, a prompt-injection incident, or a leaked token has already exposed the gap.
How It Works in Practice
Discovery should be treated as an active control, not an annual spreadsheet exercise. Start by querying the environment directly across code repositories, SaaS admin consoles, CI/CD pipelines, orchestration layers, and identity systems to find agent registrations, tool connectors, service principals, and API keys tied to autonomous workflows. Then correlate each finding into a live register with owner, business purpose, allowed tools, data domains, and review date.
For agentic workloads, the most useful discovery signals are often operational rather than formal: OAuth apps with broad scopes, bot accounts with human-like names, workflow runners that can call external tools, and LLM-backed services that mint short-lived tokens at runtime. Current guidance from the NIST AI Risk Management Framework and CSA MAESTRO agentic AI threat modeling framework supports this kind of continuous identification because agents can emerge outside traditional procurement and access review paths.
A practical workflow usually includes:
- Scanning identity providers for non-human principals, delegated grants, and stale OAuth consents.
- Mapping each discovered agent to a workload identity, not just a ticket number.
- Validating whether the agent can read secrets, invoke tools, or reach production data.
- Comparing the live view against the approved inventory and flagging unowned entries immediately.
- Enforcing periodic revalidation so “temporary” automations do not become permanent access paths.
This is where NHIMG research on hidden agent sprawl becomes useful, including the Moltbook AI agent keys breach and the CoPhish OAuth Token Theft via Copilot Studio, which both show how agent discovery gaps can translate into credential abuse and unauthorized execution. These controls tend to break down when discovery is limited to one platform, because agents often span multiple tenants, toolchains, and identity stores.
Common Variations and Edge Cases
Tighter discovery often increases operational overhead, requiring organisations to balance faster visibility against false positives and review fatigue. That tradeoff is real, especially when teams must separate sanctioned automation from experimental AI use by developers or business units.
Best practice is evolving for embedded agents inside SaaS products and vendor-managed copilots, where security teams may not have full admin access. In those cases, current guidance suggests combining tenant-level logs, identity telemetry, and outbound network monitoring to infer agent activity when direct enumeration is incomplete. There is no universal standard for this yet, so teams should document their detection assumptions explicitly.
Edge cases also include ephemeral agents created per session, agents spawned by end users, and internal tools that only appear when a workflow is invoked. For those, discovery should be paired with short-lived authorization and workload identity patterns so the register reflects live reality rather than deployment intent. NHIMG’s Ultimate Guide to NHIs — 2025 Outlook and Predictions reinforces that non-human access becomes manageable only when the identity lifecycle is continuously refreshed, not periodically assumed.
Security teams should treat any agent that cannot be rediscovered, owned, and rescoped on demand as an unmanaged identity, even if it was once approved.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Incomplete inventories are a discovery failure for non-human identities. |
| OWASP Agentic AI Top 10 | A1 | Agent discovery must account for hidden, autonomous agent instances. |
| CSA MAESTRO | ID | MAESTRO emphasises identification and inventory of agentic components. |
| NIST AI RMF | GOVERN | AI RMF governance requires accountability for AI systems and their use. |
| NIST CSF 2.0 | ID.AM-1 | Asset management supports discovering AI agents as environment assets. |
Continuously enumerate NHIs and reconcile each one to an owner and approved scope.
