TL;DR: Most enterprises underestimate how many AI agents are running, and platform registries miss shadow agents built on developer frameworks, local IDEs and homegrown services that authenticate through NHIs with real production access, according to Astrix Security. Discovery alone is not enough when agents can act before review cycles finish and policy decisions must move to runtime control.
At a glance
What this is: This is an analysis of AI agent discovery and enforcement, arguing that inventory alone cannot govern agents that operate through NHIs and reach production systems before review completes.
Why it matters: IAM teams need to treat AI agents as governed identities because visibility without runtime policy control leaves shadow agents free to use access that no one has formally approved.
Context
AI agent discovery is the process of finding where agents exist, how they authenticate, and what systems they can reach. The governance gap appears when those agents are deployed faster than identity teams can review them, especially when they sit outside sanctioned platform registries and still act through non-human identities.
The article frames this as an IAM problem because discovery and authorization are now coupled. If an organisation cannot inventory every agent and evaluate its permissions before action executes, it cannot claim control over agentic access in production.
Astrix Security’s announcement is the trigger, but the underlying issue is broader: current governance models assume identity is registered first and reviewed later, while many agents already operate with shared credentials, no named owner and no stable approval path.
Key questions
Q: What breaks when AI agents are deployed without a registry?
A: Without a registry, teams lose the ability to tie runtime behavior to a verifiable identity, which means scopes, audit trails, and revocation become fragmented or invisible. That creates shadow agents, over-permissioning, and weak accountability across distributed environments.
Q: Why do AI agents create more governance risk than ordinary integrations?
A: AI agents can connect quickly, run continuously, and accumulate broad permissions across multiple services. That combination makes ownership blur and scope drift more likely, so the real risk is not the tool itself but the uncontrolled access path it creates across enterprise systems.
Q: How can teams tell whether AI access is actually under control?
A: Look for evidence that access is limited by purpose, not just by account. If you can show which data the system can reach, which actions it can trigger, and how policy changes when the use case changes, you have real governance. If you only have sign-off at deployment time, control is still mostly theoretical.
Q: What should IAM teams do when an AI agent has no named owner or review record?
A: Treat the agent as an unmanaged identity and suspend reliance on implicit trust until its NHI, credential path, resource scope and accountable owner are recorded. Without those elements, IAM cannot establish who approved the access, what it can reach, or who is responsible for its continued operation.
How it works in practice
Why platform registries miss shadow AI agents
Platform-native registries only see what the platform knows about, such as agents created inside Copilot, Bedrock or Salesforce Agentforce. Agents built in developer frameworks, run locally in IDEs, or deployed on homegrown services can still authenticate through NHIs and interact with enterprise systems without appearing in those registries. That means the inventory problem is not just incomplete data, but incomplete coverage of the identity surfaces where agents leave traces. Discovery must therefore follow credentials, endpoints and infrastructure traces, not just product registration events.
Practical implication: treat platform registries as one input to discovery, not the discovery system itself.
How four discovery methods build a single inventory
The article describes four discovery paths: AI platform integrations, NHI fingerprinting, sensor telemetry and bring your own service coverage. Each one sees a different trace pattern, which is necessary because agent behaviour is distributed across identity providers, cloud services, endpoints and non-standard internal services. The technical point is that no single telemetry source can prove completeness. A usable inventory has to correlate where access is authenticated, where execution occurs and where the agent leaves evidence of action.
Practical implication: correlate identity, endpoint and service telemetry to build one inventory instead of managing fragmented agent lists.
Why discovery must connect to policy enforcement
A discovered agent is still an open risk if its permissions are uncontrolled. The article’s policy engine evaluates allow, flag and block decisions before an action executes, which shifts governance from retrospective review to pre-execution control. That matters because AI agents can write, delete and execute through the same credentials they used to appear in the first place. In operational terms, discovery answers who or what is present, while enforcement answers what that identity is allowed to do at runtime.
Practical implication: pair discovery with pre-action policy decisions so known agents cannot keep using unchecked privilege.
NHI Mgmt Group analysis
Shadow AI discovery is now an identity inventory problem, not a platform inventory problem: the article shows that sanctioned registries only expose the agents a platform already knows about. Agents running locally, through homegrown services or via developer frameworks remain outside that view even while they authenticate through NHIs. The implication is that governance teams must stop treating platform visibility as completeness.
Review cadences built for human-paced change collapse when agents deploy in minutes: the article makes the timing gap explicit. A review cycle measured in weeks cannot govern identities that can be created, connected and used before the review concludes. That means the programme assumption is wrong at design time, not just slow in execution.
Policy without discovery is blind, and discovery without policy is informational only: the post is strongest when it treats the two capabilities as a single control system. Knowing an agent exists does not establish whether its access should persist, and knowing its access policy exists does not help if the agent was never found. Practitioners should evaluate both halves together.
Agent identity governance now sits at the boundary of NHI and IAM operations: the article shows that agent access is exercised through NHIs, but the accountability problem lands in IAM because owners, approvals and runtime policy are still governed there. That cross-domain overlap is where programme design needs to change, because no single control plane can solve the problem alone.
Runtime enforcement is the named concept that changes the category: discovery surfaces the agent, but runtime policy control determines whether the agent may act. That distinction matters because static approval models cannot keep up with autonomous-seeming execution paths that are evaluated only after the action has already mattered. Practitioners should treat runtime policy as the control boundary.
From our research library:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and insufficient risk controls.
- Read next: Agentic AI Identity Guide
What this signals
Runtime policy becomes the real control boundary for AI agents: once an agent can act through an NHI, visibility only proves presence. The programme question becomes whether action is allowed before execution, not whether the agent can be named after the fact.
AI agent governance now depends on identity correlation across systems: teams need to connect platform traces, endpoint evidence and NHI usage into one inventory view. Without that correlation, shadow agents will continue to exist as unauthorised but operational identities.
Discovery and enforcement are now inseparable in agent governance: a control stack that finds agents but cannot constrain them leaves a material gap, while a policy engine without complete discovery cannot be trusted to cover the full estate. The practical next step is to align inventory and runtime authorisation in the same operating model.
For practitioners
- Map every agent trace source Inventory platform registries, NHI logs, endpoint telemetry and homegrown service traces as one discovery problem instead of separate tool outputs.
- Tie each agent to its executing NHI Record the NHI, credential path, resource scope and human owner for every agent so access can be governed as an identity relationship, not a feature list.
- Add pre-execution policy gates Use allow, flag and block rules that evaluate agent actions before they run, with special handling for unrecognized agent activity.
- Separate discovery completeness from policy approval Measure whether an agent is visible and whether its permissions are actually acceptable, because those are different control questions.
Key takeaways
- AI agents are becoming an IAM issue because they can operate through NHIs with production access before review cycles complete.
- Platform registries alone do not produce complete visibility, which leaves shadow agents outside normal governance and approval paths.
- The control gap is closed only when discovery is paired with runtime policy enforcement that evaluates what an agent may do before it acts.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, MITRE ATT&CK and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 — Vulnerable Third-Party NHI | Shadow agents emerge through unmanaged NHI paths and third-party platforms in the article. |
| NHI-05 — Overprivileged NHI | The article repeatedly notes agents with access broader than their governance record supports. | |
| NHI-10 — Human Use of NHI | Human operators rely on NHI-backed agents without the usual review and accountability path. | |
| Recommendation — Inventory agent-authenticating NHIs and flag any access path that is not tied to an approved owner. Reduce agent access scope to the minimum required and review any excess entitlement immediately. Separate human approvals from machine execution and require accountable ownership for every agent identity. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The central problem is whether agent permissions are known and controlled before execution. |
| Recommendation — Validate agent entitlements continuously and block execution when permissions are unapproved or unknown. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article centres on credentials that grant agents access to production systems. |
| Recommendation — Govern agent credentials through IA-5 so shared or stale authenticators cannot silently expand access. | ||
| MITRE ATT&CK | TA0006; TA0040 — Credential Access; Impact | The threat pattern hinges on credential-enabled access and the resulting production impact. |
| Recommendation — Map unmanaged agent access to credential-access and impact techniques to prioritise runtime containment. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agents are using inherited identity and privilege in ways governance did not explicitly approve. |
| Recommendation — Constrain agent identity and privilege paths so runtime actions cannot exceed authorised scope. | ||
Key terms
- AI Agent Discovery: AI Agent Discovery is the process of finding and cataloging software agents that operate with some independence across systems, data, and workflows. It identifies where agents run, what they can access, which identities they use, and how they connect to tools, APIs, and other services for governance and security.
- Runtime Policy Enforcement: Runtime policy enforcement evaluates a request at the moment it is executed instead of relying only on preconfigured permissions. For AI agents, this allows decisions to reflect current context, target sensitivity, and behavioural signals rather than static assumptions.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on May 28, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org