Excalidraw skills turn agent self-maps into a governance control

At a glance

What this is: This is a WorkOS analysis of Excalidraw skills that let agents draw their own capabilities, connectors, and routing as a live architectural snapshot.

Why it matters: It matters because IAM and NHI teams need a reliable way to understand changing agent capability sets, not just static documentation, when reviewing access, dependencies, and change impact.

Context

Agent self-mapping is a way for an AI system to produce a current diagram of its own skills, connectors, and routing rather than relying on a separate document. The identity governance problem is that the control surface changes as fast as the system does, which makes configuration review, dependency tracking, and access verification harder to do from static artefacts.

In practical terms, the article is about using Excalidraw skills to turn agent configuration into something people can inspect visually. That matters for agentic AI programmes because the question is no longer only what the agent can do, but whether the organisation can still explain and govern what it can reach right now.

Key questions

Q: How should security teams govern agents that can describe their own architecture?

A: Security teams should treat self-generated architecture diagrams as review evidence, not as proof of safety. The diagram can show what skills and connectors exist, but governance still depends on approved configuration, entitlement records, and current access validation. If the generated view and the authoritative state diverge, the control has already failed.

Q: Why do self-generated agent diagrams matter for access reviews?

A: Because they reduce the gap between declared access and actual connectivity. If an agent can show its current integrations, reviewers can more quickly spot connector sprawl, unintended dependencies, and stale documentation. That makes the review about operational reality rather than a configuration file that may no longer match the system.

Q: What breaks when agent documentation is allowed to go stale?

A: The review process breaks first, because teams start certifying a description instead of a live system. Over time, that creates false confidence about what the agent can access and what changes have taken effect. In complex agentic environments, stale documentation is a governance failure mode, not just an inconvenience.

Q: How can teams tell whether an agent has too much reachable capability?

A: Look for widening connector sets, dependency chains that are hard to explain, and diagrams that change more often than governance records. If the self-map reveals more paths than the policy allows, the agent has outgrown its approved scope. That is a sign to re-evaluate boundaries before the system becomes harder to reason about.

Technical breakdown

How agent self-mapping works in practice

An Excalidraw skill lets an agent generate structured diagram output rather than free-form text. The important technical shift is that the agent is composing a machine-readable representation of its own skills, connectors, and routing, then rendering that into boxes, arrows, labels, and semantic groupings. That makes the diagram current at the time of generation, not a manually maintained artefact. For complex agentic systems, that reduces the gap between configuration state and human understanding. It also creates a clearer view of tool relationships, which is useful when agents chain skills or expose multiple integration paths.

Practical implication: treat self-generated diagrams as an inspection aid, not as a control substitute, and verify them against live configuration.

Why visual system maps help governance reviews

Visual system maps compress a large amount of operational detail into something a reviewer can reason about quickly. In agentic environments, the core problem is not only that there are many tools, but that the set of tools, skills, and routes can change often enough to outpace readme files and diagrams maintained by hand. A live map makes dependency chains, redundant capabilities, and broad integration surfaces easier to spot. For identity teams, that matters because the review target is no longer just access on paper, but actual runtime reachability across messaging, files, web, and APIs.

Practical implication: use live system maps during access reviews and architecture reviews to compare declared scope with actual agent connectivity.

Where self-description stops and authorisation still matters

A system that can describe itself is not automatically a system that should be trusted to govern itself. The article describes an autonomous AI agent, but the governance value comes from visibility, not from delegated approval authority. Access scope, connector privilege, and change verification still need explicit policy boundaries because a diagram can show what exists without proving what should be allowed. That distinction is central to NHI governance and agentic AI security: observability improves comprehension, but authorisation remains a separate control layer.

Practical implication: pair self-mapping with explicit authorisation controls so the diagram reflects governed access rather than merely exposed capability.

Threat narrative

Attacker objective: The objective is not compromise in the classic sense but uncontrolled expansion of reachable capability that weakens oversight and increases the chance of unsafe agent behaviour.

1. Legitimate agent access exists across messaging, file, browser, and API integrations, giving the system enough reach to represent itself accurately.
2. As new skills and connectors are added, scope can drift faster than documentation updates, which widens the review gap between intended and actual access.
3. The operational impact is governance blind spots, because teams may approve a configuration they no longer fully understand or cannot promptly audit.

Breaches seen in the wild

• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
• Anthropic GTG-1002 AI espionage campaign: A state-sponsored group ran Claude Code agents to attack about 30 organisations, harvesting and reusing credentials at machine speed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agent self-mapping creates an identity inventory problem, not just a documentation improvement. Once an agent can render its own skills and connectors, the governance question shifts from "what is this system supposed to do?" to "what is it actually wired to do right now?" That is a stronger control posture because it exposes configuration drift as a reviewable artefact. The practitioner conclusion is that agent inventory must become a living control, not a periodic document.

Runtime visibility does not remove the need for authorisation boundaries. A self-generated diagram can show current access paths, but it does not decide which paths are acceptable. That distinction matters for NHI governance because visibility alone can normalise overreach if teams start treating legibility as assurance. The practitioner conclusion is that a readable agent is still a governed agent, not a trusted one.

Documentation drift is becoming an agentic AI governance debt. Static README files and hand-drawn diagrams fall behind as soon as connectors, skills, or routing rules change. The result is a programme that believes it is reviewing one system while operating another. The practitioner conclusion is to treat drift itself as a measurable governance signal.

Access review processes assume scope is stable long enough to review; agentic systems can change scope before the review cycle closes. That assumption was designed for slower-moving configurations and fails when agents can add, remove, or rewire capabilities faster than human governance cadence. The implication is that practitioners must rethink what counts as a reviewable state, because the artefact may already be stale when the reviewer sees it.

Visual self-description is becoming a useful named concept for agent governance. It gives security teams a repeatable way to surface capability sprawl, connector exposure, and dependency chains without reading raw configuration. The practitioner conclusion is that self-maps should sit alongside policy and logs as a first-class control evidence source.

From our research library:

• Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.

What this signals

Visual self-description is emerging as a practical control for agentic AI programmes. When agents can draw their own skills and connectors, teams gain a living artefact that helps expose capability sprawl and change drift. The governance value is not the diagram itself, but the ability to compare runtime reality with approved scope before reviews become stale.

For IAM and NHI practitioners, the important shift is that documentation is no longer the primary source of truth. Self-maps, change records, and authorisation controls need to line up, or else the programme ends up certifying yesterday's architecture. That is where agentic systems start to behave like a governance problem, not just a tooling problem.

For practitioners

• Implement live agent capability inventories Require each agent to produce a current map of its skills, connectors, and routing whenever configuration changes occur, then compare it with approved scope. The goal is to make drift visible before it becomes assumed truth.
• Separate observability from authorisation Review self-generated diagrams as evidence of what the agent can reach, but keep access decisions in a distinct authorisation workflow with explicit approval criteria.
• Use self-maps in architecture reviews Ask for a diagram before and after connector or skill changes so reviewers can see added dependencies, new data paths, and widened integration surfaces in one view.
• Treat documentation drift as a control signal Track when README files, diagrams, and live system maps diverge, and make that divergence part of change-management and recertification discussions.

Key takeaways

• Agent self-maps turn configuration into an inspectable governance artefact, which helps teams see what the system can actually reach.
• The main risk is documentation drift, because static descriptions fall behind changing agent skills, connectors, and routing.
• Teams should pair self-generated diagrams with explicit authorisation and change control so runtime visibility does not get mistaken for access assurance.

Key terms

• Agent Self-Mapping: Agent self-mapping is the practice of having an AI agent generate a live diagram of its own skills, connectors, and routing. In agentic environments, it turns configuration into an inspectable governance artefact that helps teams compare actual capability with approved scope.
• Workflow Drift: Workflow drift happens when an access or provisioning process slowly diverges from its approved design. In AI-enabled environments, drift can occur when generated workflows omit edge cases, approvals, or exception logic, creating a gap between what the organisation thinks it enforces and what actually runs.
• Scope Sprawl: Scope sprawl is the accumulation of excessive, duplicated, or stale OAuth permissions across many applications and users. It usually grows when teams approve broad access for convenience and never remove it, leaving a large and poorly understood delegated-access surface.
• Runtime Visibility: The ability to observe what an AI client actually accessed, which tools it used, and how it behaved during a session. It is more useful than entitlement snapshots for agent governance because it captures executed reality, not just approved access.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.