AI agent sprawl turns governance gaps into hidden cost and access risk

At a glance

What this is: NHI Mgmt Group's analysis, drawing on AvePoint's blog post: AI agent sprawl is growing faster than governance, leaving organisations with hidden cost, unmanaged access and weak lifecycle control.

Why it matters: IAM, NHI and security teams need a way to inventory agents, assign ownership and review access before AI adoption creates invisible cost and compliance debt.

By the numbers:

• Gartner projects the average Fortune 500 enterprise will run more than 150,000 AI agents by 2028, up from fewer than 15 in 2025.
• Only 13% of organizations believe they have adequate governance in place for that growth.
• AvePoint's State of AI 2026 report found 86% of organizations delayed AI agent deployments by an average of nearly six months due to unresolved data security and data management concerns.

Context

AI agent sprawl is the uncontrolled growth of agents, copilots and workflow automations across an environment without a central inventory, named owner or recurring access review. That gap matters because an agent is not a passive licence seat: it keeps taking actions, consuming tokens and holding permissions long after the project that created it has moved on.

The governance failure is familiar to identity teams, even if the asset class is new. When ownership, lifecycle and access scope are not bound together, organisations lose the ability to answer basic questions about what exists, who is responsible for it and what data it can reach. In practice, sprawl becomes a control-plane problem before it becomes a budget problem.

Key questions

Q: How should security teams inventory AI agents across SaaS, cloud, and low-code platforms?

A: Security teams should inventory AI agents by linking each connected identity to its owner, permissions, data sources, and execution scope across every platform they touch. The goal is not just discovery but accountability, so shadow deployments, stale tokens, and hidden automations can be brought under a single governance model before access sprawl turns into business exposure.

Q: Why do AI agents need named owners and lifecycle reviews?

A: AI agents need named owners and lifecycle reviews so someone is accountable for their delegated authority, tool access, data reach and revocation when the agent is no longer needed or changes purpose. The owner approves scope, monitors behaviour, and ensures credentials, tokens and permissions are removed or rotated at offboarding, role changes or drift.

Q: How should teams govern AI tool access without slowing adoption?

A: Use the same identity lifecycle controls you already apply to critical enterprise systems, then automate provisioning, role updates, and revocation so governed access is faster than ad hoc approvals. The goal is not to create a special AI process, but to make approved access the path of least resistance.

Q: How do AI agents and unsanctioned AI use differ?

A: AI agents are provisioned and governed software identities with an accountable owner, defined scope, approved tool access and reviewable controls. Unsanctioned AI use is shadow use of AI tools or models without approval, often outside policy, logging or data controls. The key difference is whether identity, access and oversight are formally assigned.

Technical breakdown

Why agent inventory is the first control point

Agent inventory is the foundation because every other control depends on knowing what exists. In AI environments, discovery has to span sanctioned and shadow deployments across cloud and SaaS platforms, then attach an owner, purpose, data scope and retirement date to each record. Without that baseline, teams end up managing licence lines and usage dashboards while the actual identity-bearing workload remains untracked. The mechanism is the same one identity programmes use for service accounts: if the object is not enumerated, it cannot be governed, reviewed or decommissioned reliably. See the AI Agent Identity Security Buyer's Guide.

Practical implication: Build continuous discovery for AI agents before trying to optimise cost or permissions.

How standing access amplifies agent sprawl

Standing access turns agent sprawl from a visibility issue into a security issue. An agent with persistent access to data sources, models or workflow tools can keep operating after the business justification has expired, which means its permissions often outlive the control that approved them. The risk is not just overexposure of sensitive data. It is also the inability to tell whether an agent still needs a connection at all. For identity programmes, this is a lifecycle problem: access that is never re-certified becomes implicit trust with no end date. See the AI Agent Authorisation Guide.

Practical implication: Tie every agent permission to a review cycle and revoke access when the agent no longer has an active purpose.

Why cost control and governance have to be one workflow

Cost signals are useful, but they do not prove legitimacy. An agent can burn tokens, consume compute and duplicate another team’s workflow while still looking acceptable on a finance dashboard. That is why usage metering and governance cannot sit in separate workflows. The real control question is whether the organisation can link spend to an owner, a business purpose and a current access scope. In practice, budget anomalies are often the first clue that an agent has outlived its design intent, but the resolution path has to begin with identity and lifecycle data, not finance alone.

Practical implication: Join spend telemetry with ownership and access review so finance noise becomes a governance signal.

Breaches seen in the wild

• postmark-mcp malicious MCP server 2025: A fake Postmark MCP server on npm quietly BCC'd every email AI agents sent through it to an attacker, using victims' own Postmark tokens.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI agent sprawl is an identity governance problem before it is a productivity problem. The critical failure is not that organisations are building agents too quickly, but that they are treating agents as disposable workflow components instead of governed identities with owners, scope and retirement dates. Once an agent can act, access data and persist beyond the project that created it, it belongs inside the same control model used for other privileged non-human identities. The practitioner conclusion is simple: govern the agent as an identity object, not as a software feature.

Cost visibility without lifecycle governance creates a false sense of control. Spend dashboards can show token and compute growth, but they cannot answer whether an agent is legitimate, still needed or over-scoped. That creates the named failure mode of agent governance debt: a backlog of unowned, unre-certified agents that accumulate both spend and exposure. Organisations should treat that debt as a board-level governance issue because the control gap compounds as the agent estate scales.

Shadow AI is the least governable form of agent sprawl because it begins outside the inventory. If a deployment never enters the register, every later control becomes reactive instead of preventative. That is why discovery, ownership and access review must be tied together from the start, including for agent observability and response where incidents or unwanted changes need attribution. The practitioner conclusion is to close the intake gap before trying to tune downstream controls.

The market is moving toward agent governance platforms, not point controls. The article’s underlying pattern is that discovery, access and recovery are converging into one operating requirement. Identity tools alone do not cover spend, and security tools alone do not establish ownership or lifecycle closure. The practitioner conclusion is to evaluate whether current controls can produce a complete agent record across creation, use, review and retirement.

Governing AI agents needs the same discipline as privileged identity management, but with faster churn. Agents can be created, cloned and abandoned far more quickly than traditional service accounts, which means static certification cycles will lag the environment unless automation fills the gap. That makes the identity intersection explicit: AI agents are non-human identities whose privileges must be scoped, reviewed and revoked as a routine operational process. The practitioner conclusion is to treat rapid agent turnover as a design constraint, not an exception.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• 69% of organisations still authenticate machine identities with long-lived API keys, according to the 2026 State of AI Agent Identity Security Report.
• Read next: Agentic AI Identity Guide

What this signals

Agent governance debt: organisations that let agents accumulate faster than review cycles create a backlog of unowned access, duplicated workflows and invisible spend. The control problem moves from deployment to lifecycle management, and the longer ownership stays unclear, the harder it becomes to prove which agents still deserve production access.

Practitioners should expect AI governance to converge with identity governance, because agents behave like non-human identities with permissions that must be scoped and revoked. Inventory, ownership and access review will increasingly be treated as one operating model rather than separate finance, security and platform tasks.

The operational signal to watch is not just breach activity but the rate at which new agents appear without a retirement date. Where that rate rises faster than re-certification, the programme is no longer governing agents. It is simply observing sprawl.

For practitioners

• Implement continuous AI agent discovery Scan every cloud and SaaS environment for sanctioned and shadow agents, then maintain a live inventory with owner, purpose, data scope and retirement date.
• Bind every agent to a named accountable owner Require one accountable business or technical owner per agent so no deployment can remain unreviewed, unowned or impossible to decommission.
• Re-certify agent access on a fixed cadence Review each agent’s data connections and permissions at a set interval, and remove access when the business purpose has changed or ended.
• Join finance and identity telemetry Correlate token consumption, compute spend and licence use with the agent inventory so duplicate or orphaned agents surface as governance exceptions.

Key takeaways

• AI agent sprawl creates cost leakage and security exposure at the same time, because agents keep spending and accessing data after their original purpose has faded.
• The scale problem is accelerating quickly, with enterprise agent counts projected to rise sharply while governance maturity remains low.
• The practical response is to govern agents as identities: inventory them, assign owners, review access and retire what no longer has a valid business purpose.

Related NHI Mgmt Group resources: AI Agent Authorisation Guide · AI Agent Identity Security Buyer's Guide · AI Agent Observability, Audit and Incident Response Guide · Agentic AI Identity Guide

Key terms

• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Agent Governance: Agent governance is the set of policies, controls, and evidence required to manage autonomous software as a non-human identity. It covers consent, tool access, lifecycle review, audit logging, and revocation so that an agent remains bounded as its workflows change.
• Agent Inventory: A governed record of every AI agent in use, including who created it, who can invoke it, what data it can reach, and what actions it can trigger. Without a current inventory, security teams cannot judge whether agent access still matches the business purpose.
• Standing Access: Standing access is persistent privilege that remains available without fresh approval or contextual checks. In NHI environments, standing access usually appears as long-lived tokens, reusable service accounts, or broad roles attached to automation. It is convenient operationally, but it expands risk when conditions change or secrets leak.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security and secrets management. It helps security, IAM and GRC practitioners build the operating model needed to govern agents as identities.