TL;DR: Employee-built agents are already operating inside enterprises with broad access, unclear ownership, and little oversight, and Aizome argues that BYOA creates a governance gap larger than the earlier BYOD problem. The issue is not just more automation but a control model built for static devices facing runtime-adapting actors that reason and act independently.
At a glance
What this is: Aizome describes BYOA as a current governance problem where employee-built AI agents already operate inside enterprises with broad access, weak oversight and unclear ownership.
Why it matters: IAM, IGA and NHI teams need to treat employee-built agents as governed identities because runtime behaviour, delegated access and accountability now matter as much as initial provisioning.
By the numbers:
- Only 24% of organisations have full visibility into which AI agents are communicating with each other, according to Aizome.
- The average enterprise now manages 37 deployed agents, according to Aizome.
Context
Bring Your Own Agents, or BYOA, describes employees building and deploying AI agents inside the enterprise without central security review or lifecycle control. The article argues that this is no longer a future concern: the governance gap already exists because these agents connect to business systems, external APIs and internal data paths before security teams know they are present.
The identity problem is that BYOA agents do not behave like devices or static accounts. Their permissions, workflows and data access can shift by task, which means existing IAM and NHI controls built around stable inventories, fixed scopes and periodic reviews miss the real control point: runtime behaviour and accountable ownership.
Key questions
Q: What breaks when employee-built agents are deployed without inventory or ownership?
A: The governance chain breaks first. Without an inventory entry and named owner, teams cannot review access, investigate behaviour, revoke permissions or prove accountability when the agent changes scope. The result is shadow AI that remains active because no one can tie its actions back to a responsible business or security owner.
Q: Why do BYOA agents create more risk than BYOD devices did?
A: Because the risk is not only the object entering the enterprise, it is the actor changing its behaviour at runtime. Devices are largely stable and visible on the network. Agents can expand scope, call tools and inherit trust from upstream workflows while security teams still think in terms of static policy and endpoint control.
Q: How do security teams know if an AI agent is operating outside its approved role?
A: Teams should compare actual workflow behaviour against the approved use case. Signs of trouble include unexpected record access, unapproved action types, new system paths after an update, or repeated attempts to exceed the intended scope. In healthcare, behaviour review matters as much as entitlement review because unsafe actions often appear first as workflow drift.
Q: What should organisations do when an agent inherits access through another workflow?
A: Treat that as a trust propagation problem, not a simple entitlements issue. Review the upstream workflow, the delegated context and the downstream systems the agent can now reach. If the inherited access cannot be explained and bounded, the agent should not keep those connections.
Technical breakdown
Why BYOA agents break static policy models
BYOA agents are not passive endpoints. They reason over a task, choose actions, call tools and continue operating without a human pausing each step. That matters because policy models built for devices assume a stable object, a fixed configuration and a predictable compliance state. An agent does not have one fixed footprint. Its data access, tool use and downstream effects can change every time it runs, so the governance problem is not just authorization at entry but continuous control over what the actor becomes during execution.
Practical implication: treat runtime behaviour as the control surface, not just the initial approval event.
How shadow AI agents create identity and ownership gaps
The article's strongest governance warning is not simply that agents exist, but that many exist without inventory, logging or a documented human owner. In identity terms, that is a broken chain of accountability. If no one can map the agent to an owner, a boundary and an access profile, then lifecycle controls such as review, revocation and offboarding cannot work. The result is shadow AI that persists because the enterprise cannot prove who authorised it or who is responsible when it changes scope.
Practical implication: require a human owner, a unique identity and a discoverable inventory entry for every deployed agent.
Why inherited trust is the hardest BYOA failure mode
Aizome's most interesting failure mode is the inherited trust agent, where permissions may look correct on paper but the agent inherits authorization context from upstream workflows or human actions. That is a classic delegation problem, but amplified by autonomous execution. The control failure is not only overprivilege. It is hidden trust expansion across workflows, integrations and chained actions that security teams never explicitly approved. That is why intent-aware governance matters more than a simple permissions checklist.
Practical implication: map downstream trust chains, not just direct entitlements, before allowing agent-to-system integrations.
Threat narrative
Attacker objective: The objective is not a traditional intruder outcome, but uncontrolled operational access that enables an agent to act beyond its intended scope without effective oversight.
- Entry occurs when an employee builds or deploys an agent directly into enterprise workflows without security review, inventory or governance approval.
- Credentialed access then allows the agent to reach ERP, CRM, ticketing, cloud storage and external APIs, often with hardcoded or broadly scoped permissions.
- Escalation happens as the agent's task scope expands over time or it inherits upstream authorization context from connected systems and workflows.
- Impact is broad operational exposure, because the enterprise loses visibility, accountability and control over what the agent can access or do.
Breaches seen in the wild
- Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
- Vercel Context.ai OAuth Supply Chain Breach: Shadow AI app Context.ai OAuth integration exposes Vercel customer data via unmanaged third-party token.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
BYOA exposes an identity governance model built for stable subjects, not runtime-adapting actors. The article is right to frame this as larger than BYOD because the underlying assumption is different: devices stay what they are, while agents change what they can do from task to task. That means the enterprise is not only managing access, it is managing behaviour under delegation. Practitioner implication: governance for agents has to move from static approval to runtime accountability.
Shadow AI becomes a lifecycle problem the moment owners cannot be identified. An agent without inventory, owner or audit trail is not just undiscovered software, it is an ungoverned identity with live access. That breaks the core assumption behind recertification, offboarding and access review, all of which depend on knowing what exists. Practitioner implication: if an agent cannot be attributed to a human owner and a clear boundary, it cannot be governed.
Inherited trust is the named concept that best captures BYOA's hidden risk. The article shows that many agent permissions look acceptable until upstream workflows, delegated context or chained automations quietly enlarge what the agent can do. This is not merely overprivilege at provisioning time, it is trust expansion during execution. Practitioner implication: security teams need to govern trust propagation across workflows, not just the agent's direct entitlement set.
BYOA validates the shift from identity inventories to identity behaviour controls. A program that only knows which agents exist will still miss what those agents are doing, especially as access and intent drift during use. That is why the challenge is broader than NHI inventory management and closer to continuous governance of autonomous actions. Practitioner implication: the operating model has to include discovery, behavioural baselines and runtime enforcement together.
The market will increasingly converge on agent visibility, authorisation and observability as separate control layers. The article describes capabilities that traditional IAM, MDM and coarse NHI approaches do not cover on their own. That suggests the category is moving toward specialised control planes for agent identity rather than simple extensions of human identity tooling. Practitioner implication: teams should evaluate whether their current stack can follow agent behaviour across systems, or only register the agent at the gate.
From our research library:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
- 76% of organisations cite shadow AI as a definite or probable problem, up from 61% in 2025, according to HiddenLayer's 2026 AI Threat Landscape Report.
- Read next: AI Agent Observability, Audit and Incident Response Guide
What this signals
Inherited trust is the governance blind spot that matters most here: when an agent can inherit access from workflows or upstream actors, the enterprise is no longer reviewing permissions alone. It has to review how trust moves across systems, because the risk is created by delegation chains rather than by a single overprivileged account.
The immediate programme implication is that agent discovery, owner mapping and behavioural monitoring need to be treated as one operating model. If any one of those layers is missing, BYOA becomes invisible enough to outpace access reviews and broad enough to evade traditional IAM assumptions.
For practitioners
- Build an enterprise agent inventory Discover every employee-built or team-built agent, assign an owner, record its integrations and keep the inventory continuously updated.
- Map agent trust chains Trace how each agent inherits permissions, upstream workflow context and delegated access across ERP, CRM, ticketing and cloud systems.
- Move governance to runtime checks Validate agent actions against expected behaviour, not just approved entitlements, so scope drift is visible while the agent is active.
- Separate approval from execution rights Require a documented boundary between what the agent may request and what it may execute without human intervention.
- Define agent offboarding triggers Revoke access when an agent loses an owner, changes purpose or begins using connections that were not part of its original scope.
Key takeaways
- BYOA is an identity governance problem, not just an automation trend, because employee-built agents already operate across enterprise systems with unclear ownership and runtime-changing access.
- The article's core evidence is the scale of the visibility gap, including 24% full visibility into agent communications and more than half of agents running without oversight or logging.
- The control gap is trust propagation, so teams need inventory, behavioural baselines and runtime enforcement rather than device-style policy alone.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Agents without owners or inventories cannot be retired or reviewed cleanly. |
| NHI-05 — Overprivileged NHI | BYOA agents accumulate access across ERP, CRM and workflow tools beyond initial scope. | |
| NHI-10 — Human Use of NHI | Employees are creating and operating agents directly inside business workflows without central governance. | |
| Recommendation — Establish agent offboarding rules so unmanaged agents lose access when ownership or purpose changes. Constrain agent entitlements to the minimum reachable systems and data paths required for each task. Govern employee-built agents as enterprise identities instead of letting individual users manage them ad hoc. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article describes broad access paths and cross-system reach once agents are deployed. |
| Recommendation — Map agent cross-system reach to credential access and lateral movement paths in detection and review workflows. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The central issue is whether agent entitlements are governed beyond initial approval. |
| GV.RM-01 — Risk Management Strategy | BYOA needs a governance model that explicitly accounts for runtime-adapting actors. | |
| Recommendation — Apply PR.AA-05 to validate agent entitlements against current business scope and revoke excess access. Update risk strategy to cover employee-built agents as governed identities with runtime behaviour risk. | ||
Key terms
- Bring Your Own Agents (BYOA): A pattern where employees build and deploy AI agents outside central security review. These agents often connect directly to enterprise systems, creating identity, access, and accountability issues that look like shadow IT but behave more like shadow AI.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Inherited Trust: Access or authority an agent effectively receives from a surrounding workflow, upstream agent, or human process rather than from its own direct permissions. This can make the agent appear properly scoped while its real operational reach is broader than the entitlement record suggests.
- Behavior Baseline: A record of normal activity for a non-human identity, including typical consumers, resources, and actions over time. Baselines help security teams detect when an identity is being used in an unusual way and provide the context needed to enforce least privilege safely in dynamic environments.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org