AI agent discovery is the missing layer in identity governance

At a glance

What this is: This is an analysis of why AI agents are hard to inventory and why agent identity needs discovery, ownership, and review separate from standard NHI tracking.

Why it matters: It matters because IAM, IGA, and security teams cannot govern what they cannot reliably identify, assign, or review across human, NHI, and agentic workflows.

By the numbers:

• NHIs outnumber human identities by 25x to 50x in modern enterprises.
• Only 5.7% of organisations have full visibility into their service accounts.
• 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.

👉 Read C1.ai's analysis of AI agent discovery and ownership in identity governance

Context

AI agent discovery is an identity governance problem, not just an inventory problem. These systems often authenticate through credentials and delegated access that look ordinary at first, then behave unlike static service accounts once they start composing actions across systems. For teams managing IAM and NHI programmes, the challenge is separating agent behaviour from generic machine access.

The article’s central point is that discovery and ownership have to be solved together. If a team can find an agent but cannot tie it to a durable human owner or responsible team, then access reviews, offboarding, and incident response all fail in practice. That is why agent identity governance now belongs alongside NHI inventory, not inside it.

C1.ai’s framing aligns with the broader visibility problem already seen in NHI programmes: shadow identities appear outside established onboarding paths, especially when application teams create them directly. The same pattern now applies to AI agents, which makes agent discovery a lifecycle issue as much as a detection issue.

Key questions

Q: What breaks when AI agents are treated like standard human users?

A: You lose visibility into effective permissions, expected behaviour, and real blast radius. Human-centric controls can misclassify normal agent activity as compromise, or miss policy violations that happen entirely within legitimate access. The failure is not only technical, it is governance design that assumes a person is always behind the action.

Q: Why do AI agents require ownership as well as discovery?

A: Discovery tells you an agent exists, but ownership determines who can review it, offboard it, and answer for its actions. Without a durable owner, the identity can persist without a revocation path, and the organisation ends up with visibility but no accountable control.

Q: How should security teams discover AI agents that were never formally deployed?

A: Use identity and telemetry correlation to look for agents that authenticate, retrieve secrets, assume roles, or call APIs without a matching onboarding record. The goal is to identify active non-human identities before they become blind spots in governance. Every discovered agent should be assigned an owner, a scope, and a review path.

Q: Should agent identities be governed inside the same lifecycle as human users and service accounts?

A: Yes, but not with the same assumptions. Agents need the same lifecycle disciplines, including review and offboarding, yet they must be governed through behaviour-aware discovery and durable ownership because their access patterns can change faster than human-centric review cycles.

Technical breakdown

Why AI agents look like service accounts until they do not

AI agents often inherit the same authentication plumbing as other non-human identities, including API keys, OAuth grants, and delegated tokens. The technical difference is behavioural, not merely credential-based: a service account usually performs a narrow, predictable function, while an agent may chain actions across multiple systems based on runtime context. That means simple inventory methods can miss the real risk object, because the credential alone does not reveal the agent’s effective scope. In practice, the identity problem sits at the intersection of authentication, orchestration, and delegated access.

Practical implication: Classify identities by observed behaviour and authorisation pattern, not by the label attached to the credential.

Discovery signals for agent identity inventory

Agent discovery depends on joining three signal types. First, credential patterns such as broad OAuth scopes, long-lived API keys, and tokens issued to orchestration frameworks. Second, behavioural signatures such as one identity touching unrelated systems in short windows or changing access patterns without a corresponding change record. Third, creation context, including who minted the credential, from where, and for which project or tool. None of these signals alone proves autonomy, but together they reveal identities that should be governed as agents rather than ordinary service accounts.

Practical implication: Build discovery logic around credential scope, behavioural variance, and provisioning context instead of relying on naming conventions.

Why ownership is part of the technical control plane

Ownership is not an administrative afterthought. Once an AI agent is tied to a human owner or accountable team, downstream controls become executable: access reviews need a reviewer, offboarding needs a trigger, and incident response needs a contact. Without that link, the identity may still exist technically, but it becomes operationally ungovernable. The article’s key lesson is that discovery without ownership creates a visibility record, not a control surface. That is the point where lifecycle management and identity security converge.

Practical implication: Bind each agent to a durable owner model before allowing it to accumulate access across production systems.

Threat narrative

Attacker objective: The objective is to gain durable, hard-to-see access through an identity that blends into normal machine activity while retaining broad operational reach.

1. Entry occurs when an AI agent is created outside central identity workflows and authenticates through an existing API key, OAuth grant, or delegated token.
2. Escalation happens when the agent compounds access across systems, so a single credential now represents a broader effective privilege set than the original provisioning record implied.
3. Impact emerges when the agent acts with no accountable owner, leaving access reviews, offboarding, and incident response without a reliable revocation or response path.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• DeepSeek breach — DeepSeek breach exposed 1M+ log lines and sensitive secret keys.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI agent discovery is now a distinct governance layer, not a subtask of NHI inventory. The article shows why traditional machine-identity registers are too static for systems that can change behaviour at runtime. A credential can tell you that access exists, but it cannot tell you whether the identity is a service account or an AI agent composing actions across systems. The practitioner conclusion is that discovery logic must move beyond inventory completeness and toward behavioural identity classification.

Shadow AI is the right concept for unmanaged agent identities. The same pattern that created unmanaged machine credentials now appears in AI agents built by application teams outside central approval paths. They often enter through low-code tools, orchestration layers, or delegated tokens, which makes them easy to miss in conventional IAM onboarding. The implication is that discovery programmes need a separate control path for agent creation context, not just post-hoc logging.

Ownership is the governance control that makes agent identity actionable. Discovery without ownership only creates a more complete spreadsheet, not a governable identity estate. Access reviews, offboarding, and incident response all require a named accountable party or team, and that requirement becomes more acute when agents are built outside IT. The practitioner conclusion is that agent identity cannot be considered governed until ownership is durable across joiner-mover-leaver events.

Agents expose the limits of provisioning-time least privilege. Least privilege assumes the effective access envelope is knowable at provisioning time, but AI agents can expand their practical reach through runtime behaviour and tool composition. That does not mean privilege no longer matters. It means the access model must recognise that the same credential can represent a much wider operational scope than the initial grant suggested, so practitioners must govern the delegated blast radius, not just the token.

From our research:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to Ultimate Guide to NHIs.
• Only 5.7% of organisations have full visibility into their service accounts, which shows how quickly inventory gaps become governance gaps.
• Agent discovery becomes a forward-looking control problem when teams can pair inventory with rotation and offboarding guidance from Guide to NHI Rotation Challenges.

What this signals

Shadow AI will increasingly look like ordinary machine identity sprawl until teams add behavioural signals to discovery. The practical shift is from counting credentials to classifying runtime patterns, which means IAM and IGA teams need discovery processes that can separate service accounts from agentic identities before ownership and review are applied.

With Ultimate Guide to NHIs showing that NHIs outnumber human identities by 25x to 50x, the operating assumption has to change: scale alone is no longer the problem, unmanaged behavioural diversity is. That makes agent inventory a governance design issue, not a tooling checkbox.

Ephemeral agent ownership becomes the new blast-radius control: if an agent can be created, copied, or redeployed by application teams, then the durable control is not the credential itself but the accountability link attached to it. Teams should expect review, offboarding, and incident response workflows to be reworked around that premise.

For practitioners

• Map agent discovery to a behavioural inventory Track API keys, OAuth grants, and delegated tokens that are tied to orchestration tools, then compare their runtime behaviour against known service-account patterns. Use the result to separate ordinary machine identities from agent identities before you assign control owners.
• Require durable ownership for every agent Assign each agent to a team or role backed by a named individual so that access reviews, offboarding, and incident response have a real human entry point. Do not leave ownership with the creator alone, because creator-based ownership breaks when staff move or leave.
• Add agent-specific discovery signals to your inventory process Include credential scope, multi-system behaviour, and creation context in the same discovery workflow so that agent identities are not hidden inside ordinary service-account records. Treat unusual cross-system access as a classification trigger, not just an alert.
• Rework review cadence for agent speed Review agents at a pace that matches their change rate, especially when they are created by application teams and can be redeployed quickly. Standard quarterly recertification is often too slow when the identity can change behaviour between review windows.

Key takeaways

• AI agents blur the line between service accounts and dynamic runtime actors, which makes credential-only inventory insufficient for governance.
• The main failure mode is not lack of access data, but lack of durable ownership that can survive reviews, offboarding, and incidents.
• Identity teams should treat behavioural discovery and accountable ownership as the two controls that turn agent visibility into actual governance.

Key terms

• AI Agent Discovery: AI Agent Discovery is the process of finding and cataloging software agents that operate with some independence across systems, data, and workflows. It identifies where agents run, what they can access, which identities they use, and how they connect to tools, APIs, and other services for governance and security.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Agent ownership: The assignment of accountable business and technical responsibility for an AI agent or automated workflow. Ownership should include approval authority, review cadence, and a clear connection to the identity that the agent uses, so that access and liability do not disappear when the workflow scales.
• Behavioural Identity Signal: A behavioural identity signal is evidence from login patterns, device changes, action sequence, location, or privilege use that helps distinguish legitimate use from abuse. It is strongest when multiple signals are evaluated together, because a single event can look normal while the overall pattern does not.

What's in the full article

C1.ai's full post covers the operational detail this analysis intentionally leaves for the source:

• Step-by-step discovery cues for identifying agent identities in logs and identity systems
• Practical ownership models for assigning agents to teams and accountable individuals
• The distinction between service account behaviour and AI agent behaviour in production environments
• Examples of how discovery, inventory, and review should work at agent speed

👉 C1.ai's full post covers discovery signals, ownership models, and the service-account distinction in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.