TL;DR: C1.ai shows that AI agents authenticate through API keys, OAuth grants, and delegated tokens, then look like service accounts in logs until their behaviour diverges. The governance gap is discovery and ownership, because agents created outside IT bypass the inventory paths built for humans and traditional NHI controls.
At a glance
What this is: This is an analysis of why AI agent discovery is now a governance gap, with the key finding that agents often hide in logs as service accounts until their behaviour changes.
Why it matters: IAM, NHI, and governance teams need a way to find, own, and review agents before they become invisible access paths that bypass existing inventory and offboarding processes.
👉 Read C1.ai's analysis of AI agent discovery and ownership in identity governance
Context
AI agent discovery is the ability to find and classify autonomous software identities before they blend into ordinary service-account traffic. In this article, the governance gap is not authentication alone, but the fact that agents are being created outside the inventory paths IAM teams already depend on.
The problem matters because agents are not static machine accounts. They are created by application teams, authenticate through API keys, OAuth grants, and delegated tokens, and can change behaviour as their prompts and tool access change. That makes discovery and ownership the first governance layer, not an afterthought.
For identity programmes, this sits at the intersection of NHI governance and emerging agentic AI identity control. If you cannot enumerate an agent, you cannot assign accountability, recertify access, or offboard it with confidence.
Key questions
Q: How should security teams discover AI agents that are not in IAM inventories?
A: Use multiple discovery paths at once: declared agent registries, repository scanning, plugin and app store monitoring, network analysis, and identity analytics. The goal is not just to find traffic, but to correlate activity back to an owner, lifecycle state, and delegated identity so shadow AI can be governed instead of merely observed.
Q: Why do AI agents and service accounts create the same governance problem?
A: Both act as non-human identities with execution authority, and both can be abused once permissions are too broad or insufficiently monitored. The practical problem is not the label, but the fact that machine identities can move fast, operate at scale, and act outside human review cycles. Governance must therefore cover behavior, scope, and revocation.
Q: What are the signs that an AI agent is already in the environment?
A: Common signs include OAuth apps with broad scopes, long-lived API keys tied to orchestration tools, identities that suddenly access unrelated systems, and creation records tied to project teams rather than central IAM. Those signals matter because they show an identity entering through application workflows instead of formal inventory channels.
Q: How should organisations assign ownership for AI agents in production?
A: Assign ownership to a named business and technical accountable party before the agent is allowed to act. The owner must be able to approve scope, review behaviour, and respond to exceptions. If the name on the record cannot influence the agent's access or operating rules, the ownership control is not real governance.
Technical breakdown
Why AI agents evade ordinary NHI inventory
Traditional NHI inventory works when identities are provisioned through known control points such as the IdP, cloud account, or secrets platform. AI agents often appear through application teams, low-code tools, or orchestration layers, which means they never pass through the front door that asset discovery expects. They may authenticate with API keys, OAuth grants, or delegated tokens, but the discovery problem is not the credential type. It is the creation path and the behavioural variability that make them hard to classify as a stable service account.
Practical implication: build discovery around creation context and runtime behaviour, not just credential registries.
Why an agent is not just a service account
A service account is usually static, narrow, and predictable. An AI agent can compose actions across systems, shift tool use based on prompts, and expand its effective privilege through the union of everything it can reach. That means the risk object is not the credential alone, but the credential plus the agent's runtime decision space. In governance terms, the same key that looks ordinary in a log can represent a much larger access surface when attached to an agent.
Practical implication: classify agent identities separately from generic service accounts when access scope can change at runtime.
Why ownership is the control that makes discovery usable
Discovery without ownership creates inventory noise, not governance. Every meaningful downstream process, access review, offboarding, incident response, and exception handling depends on linking the agent to a responsible human or team. The article's point is operational: if an agent is created by a product team and not owned in a durable way, then turnover turns that identity into an orphan. Ownership must therefore be assigned at a level that survives personnel change, not just initial creation.
Practical implication: require durable ownership assignment before an agent is allowed to keep credentials or touch production systems.
Threat narrative
Attacker objective: The objective is to obtain durable, hard-to-track access through an identity that blends into ordinary service-account activity.
- Entry occurs when an engineer wires an AI agent into a business system using a credential minted outside central IAM review.
- Credential exposure follows because the agent authenticates through API keys, OAuth grants, or delegated tokens that can sit outside normal inventory paths.
- Escalation happens when the agent composes actions across multiple systems, making its effective access larger than the original credential scope.
- Impact is loss of governance visibility, because the organisation cannot reliably review, offboard, or revoke an agent it never formally discovered.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
AI agent discovery is now a governance prerequisite, not a hygiene task. The central failure is not that organisations lack another inventory spreadsheet. It is that application teams can create agent identities outside the control paths built for human and traditional NHI onboarding. Once that happens, recertification, ownership, and offboarding all start from an incomplete map, which means the governance programme is already behind the risk.
Discovery must be tied to ownership if it is expected to change outcomes. An identity that cannot be assigned to a durable owner is not governable in practice. This is where joiner-mover-leaver logic crosses into NHI and agentic AI governance: the control is not simply finding the agent, but ensuring that its accountability survives team changes and project turnover.
AI agent behaviour breaks the assumption that machine identities are static. Service-account governance was designed for predictable identities with stable purpose and stable scope. That assumption fails when the actor composes actions across systems and changes behaviour with each prompt. The implication is that identity governance has to separate credential possession from runtime authority, because the same credential can represent a different risk object from one session to the next.
Shadow AI is becoming an identity discovery problem before it becomes an AI policy problem. If an organisation cannot distinguish an agent from a service account in logs, then policy enforcement starts too late. The field needs a broader definition of inventory that includes creation context, behavioural signals, and ownership continuity. Practitioners should treat discovery as the point where agent governance either becomes possible or remains aspirational.
Agent-speed governance will become the benchmark for credible identity control. Review cycles built around slower human and service-account lifecycles will miss agent identities that are created, modified, and used inside the same operational window. The practical conclusion is simple: if the governance model cannot keep pace with agent creation, it cannot claim coverage over agentic systems.
From our research library:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- Read next: Agentic AI Identity Guide
What this signals
AI agent governance will hinge on discovery quality before policy depth. If teams cannot reliably tell an agent from a service account, they will keep missing the ownership layer that makes access reviews and revocation possible. The operational priority is to surface agent creation context, credential patterns, and behavioural signatures before attempting to normalise them into existing NHI workflows.
Shadow AI is becoming a governance classification problem. Agents created by application teams do not respect the inventory assumptions of traditional IAM programmes, so discovery has to move closer to where identities are minted and used. According to the 2026 Infrastructure Identity Survey, only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
Ownership continuity is the control that turns discovery into accountability. If an agent cannot be tied to a team and a named owner, then joiner-mover-leaver processes cannot cleanly reassign it when people change roles or leave. That is why agent governance should be treated as a lifecycle issue, not only a detection problem.
For practitioners
- Map agent creation pathways Trace where AI agents are being created outside the IdP, cloud account, or secrets platform, especially in low-code tools and application-team workflows. Treat those paths as discovery sources, not exceptions.
- Correlate credential patterns and behaviour Look for OAuth apps with broad scopes, long-lived API keys, and identities that touch multiple unrelated systems in short windows. Pair those signals with change tickets and project context to distinguish agents from ordinary service accounts.
- Assign durable ownership Attach each discovered agent to a team or role with a named accountable individual so turnover does not orphan the identity. Ownership should survive personnel changes and be visible in access review workflows.
- Add agent review to lifecycle controls Extend joiner-mover-leaver and access review processes so agents are recertified and offboarded with the same governance discipline used for human identities and non-human identities.
Key takeaways
- AI agents are becoming a discovery and ownership problem because they can hide inside ordinary service-account telemetry until their behaviour changes.
- Discovery only matters when it is tied to durable ownership, otherwise the organisation still cannot recertify or revoke the identity with confidence.
- The governance model has to move beyond credential inventory and include creation context, behavioural signals, and lifecycle accountability.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centres on agents blending into existing identities and expanding effective access at runtime. |
| Recommendation — Map agent discovery and ownership gaps to ASI03 and separate agent authority from static credential possession. | ||
| OWASP Non-Human Identity Top 10 | NHI-03 — Vulnerable Third-Party NHI | Agents created outside central control paths behave like unmanaged non-human identities with unclear ownership. |
| NHI-10 — Human Use of NHI | The article shows humans creating and operating agents in ways that bypass governance boundaries. | |
| Recommendation — Inventory agent identities created outside central IAM and assign accountable ownership before production access. Track which human teams mint and operate agent credentials so governance follows the operator chain. | ||
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems within the organisation are inventoried | The core gap is incomplete asset and identity inventory for agents. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | Agent discovery is only useful if entitlement ownership and authorization are governed. | |
| Recommendation — Extend inventory practices so agent identities are discoverable alongside systems and accounts. Apply PR.AA-05 to ensure agent entitlements are tied to accountable ownership and review. | ||
Key terms
- AI Agent Discovery: AI Agent Discovery is the process of finding and cataloging software agents that operate with some independence across systems, data, and workflows. It identifies where agents run, what they can access, which identities they use, and how they connect to tools, APIs, and other services for governance and security.
- Agent ownership: The assignment of accountable business and technical responsibility for an AI agent or automated workflow. Ownership should include approval authority, review cadence, and a clear connection to the identity that the agent uses, so that access and liability do not disappear when the workflow scales.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Creation Context: The surrounding provenance of an identity, including who created it, from where, and in what project or platform it was attached. For agents, creation context is often the earliest reliable signal that an identity exists at all.
What's in the full article
C1.ai's full article covers the operational detail this post intentionally leaves for the source:
- How AI agent discovery signals differ from standard service-account inventory checks
- Why ownership assignment needs to survive team turnover and not just initial provisioning
- How agents created in low-code and application-team workflows escape central IAM visibility
- How to think about agent-speed governance when review cycles are slower than agent creation
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on September 24, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org