Identity discovery for autonomous systems is becoming a governance gap

At a glance

What this is: This article argues that AI agents should be discovered and governed as identities, using logs, credential patterns, and ownership signals to build an inventory.

Why it matters: It matters because IAM, NHI, and lifecycle programmes need a way to detect shadow AI, assign accountability, and right-size access before autonomous behaviour creates ungoverned exposure.

By the numbers:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%).
• Only 5.7% of organisations have full visibility into their service accounts.
• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.

👉 Read Token Security's guide to discovering and managing AI agent identities

Context

AI agent discovery is the process of finding software identities that act with credentials, API access, and delegated permissions across cloud, SaaS, and code pipelines. In practice, these identities often look like ordinary automation until you correlate token use, audit trails, and ownership records.

The governance gap is that existing IAM and NHI programmes were built around stable inventories and clearly bounded access paths. Autonomous systems create a wider search space because the same agent can surface through OAuth grants, service accounts, vault usage, and runtime telemetry, making ownership and scope harder to prove.

For security and identity teams, the question is no longer whether an agent exists but whether it is traceable, reviewable, and tied to a named business purpose. That is the difference between adopting AI and inheriting shadow AI risk.

Key questions

Q: How should security teams discover AI agents in enterprise environments?

A: Security teams should correlate identity and runtime signals across OAuth grants, API traffic, cloud logs, secrets stores, and code repositories. The goal is to identify which programmatic identities are acting as AI agents, who owns them, and what systems they can reach. Discovery is only useful when it becomes an inventory with business context, not a list of suspicious events.

Q: Why do AI agents create a different governance problem from normal workloads?

A: AI agents create a different governance problem because they combine programmatic credentials with flexible, runtime decision-making. A normal workload usually performs a bounded task, but an AI agent can shift actions across tools and data sources in ways that are harder to predict from provisioning records alone. That is why ownership, traceability, and scope validation matter more than asset discovery alone.

Q: What breaks when AI agents are not included in identity inventory processes?

A: When AI agents are excluded from inventory processes, teams lose visibility into who owns them, what they access, and whether they still need access at all. The result is shadow AI, orphaned identities, and access that can persist after the original project or business need has changed. Without inventory, review and offboarding become guesswork rather than governance.

Q: How should organisations govern AI agents after they are discovered?

A: Organisations should place AI agents under the same lifecycle controls used for other non-human identities. That means assigning ownership, validating least privilege against actual usage, reviewing access on a recurring basis, and revoking credentials when the agent is retired or repurposed. Governance only works when discovery is followed by sustained lifecycle control.

Technical breakdown

AI agent discovery through identity signals

AI agents usually do not appear as a single obvious asset. They leave identity signals across OAuth grants, API gateways, cloud audit logs, secrets stores, SaaS activity, and code repositories. Discovery works by correlating those traces into an inventory that links behaviour to an owner, a purpose, and the credentials used. This is closer to identity forensics than traditional asset discovery because the object of interest is an acting identity, not a host or application.

Practical implication: Instrument identity, cloud, and SaaS telemetry together so AI agents can be found before they become shadow systems.

Why programmatic identities hide autonomous behaviour

AI agents often sit on top of programmatic identities such as service accounts, tokens, and OAuth grants. That layering makes them look like normal machine access even when the underlying behaviour is flexible and human-directed. The technical challenge is that the credential proves authorization, but not intent or operating context. Once agents can chain tools and move between systems, the identity boundary becomes the only stable place to anchor governance.

Practical implication: Treat credential type alone as insufficient evidence of control and map each programmatic identity to the behaviour it enables.

Building an AI agent inventory

An AI agent inventory is a continuously updated record of each agent, its owner, its access scope, its credential type, and its operational status. The inventory must also capture whether the agent is attached to production data, customer workflows, or business-critical systems. Without that context, teams cannot decide whether access is proportionate or whether the identity has drifted beyond its intended use. Inventory is therefore a governance control, not just a discovery output.

Practical implication: Require every discovered agent to be entered into the identity inventory with owner, purpose, scope, and review cadence.

Threat narrative

Attacker objective: The objective is to turn an ungoverned AI agent into an access path that can reach sensitive resources without effective oversight.

1. entry via OAuth grants, API tokens, or service accounts that let an AI agent reach sensitive systems through ordinary application pathways.
2. credential access and abuse happen when the agent uses those programmatic identities to call data, SaaS, or infrastructure services beyond the original expectation.
3. impact follows when the agent becomes an untracked identity that can expose data, touch production systems, or persist without clear ownership.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI agent discovery is becoming an identity inventory problem, not a tooling problem. The article is right to focus on logs, token use, and ownership because autonomous systems rarely present themselves as a neat application object. The real governance task is to reconcile what the agent is doing with who owns it and which programmatic identity gives it reach. Practitioners should treat discovery as the front end of lifecycle control, not a one-time scan.

Identity discovery and review assumptions were designed for access that stays still long enough to be catalogued. That assumption fails when an agent can be created, granted access, and repurposed across multiple systems faster than a normal review cycle can capture. The implication is that governance models built on periodic attestation alone do not describe the behaviour of autonomous systems well enough to control them.

Programmatic credentials are now carrying behavioural ambiguity that classic machine identity models never had to absorb. A token or service account still proves authorization, but it no longer tells you whether the attached AI agent is operating within its intended task boundary or drifting into adjacent data and systems. That makes ownership context and usage correlation the decisive control plane. Practitioners should prioritize traceability over assumption.

Shadow AI is the natural outcome when AI agents are allowed to exist outside formal lifecycle governance. When creation, ownership, and offboarding are not tied to an inventory, the environment accumulates identities that can act but cannot be retired cleanly. That is why AI agent governance should be treated as lifecycle discipline applied to a new identity form, not as a separate innovation project.

Identity blast radius is the right named concept for this topic. AI agents widen blast radius because one delegated identity can connect natural language prompts, tokens, SaaS actions, and infrastructure access into a single operating chain. The article shows why practitioners need to evaluate not just whether an agent exists, but how far its credential path can reach before governance catches up.

From our research:

• Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
• The Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs shows how visibility, rotation, and offboarding fit into one control loop.

What this signals

Identity programmes will need to absorb AI agent discovery as an ongoing control, not a periodic exercise. If discovery only happens during app reviews or cloud audits, shadow AI will outrun the inventory. The practical shift is toward continuous correlation of OAuth grants, token use, and runtime activity so autonomous identities can be assigned to a real owner before they become operational debt.

Agent identity governance will increasingly sit between IAM, NHI, and application security teams. That boundary matters because the access object is programmatic, but the behaviour is agentic. Organisations that already struggle to track service accounts will find AI agents even harder to govern unless they treat ownership, purpose, and offboarding as first-class identity controls.

With 80% of organisations reporting AI agents that have already acted beyond intended scope, according to AI Agents: The New Attack Surface, the inventory question is now a risk question. The programme signal to watch is whether each discovered agent has a named owner, a bounded purpose, and a review path that can actually revoke access when behaviour drifts.

For practitioners

• Correlate discovery across identity and runtime sources Join OAuth grant records, API gateway logs, cloud audit trails, vault activity, and code repository signals so agent identities can be confirmed from multiple angles rather than from a single alert stream.
• Require ownership before access is left in place Map every discovered AI agent to a named business owner and a documented purpose, then remove or quarantine credentials that cannot be tied to a legitimate operational need.
• Right-size agent permissions to actual behaviour Compare the systems an agent really touches with the scope implied by its tokens, service accounts, and OAuth grants, then narrow access where the observed behaviour exceeds the stated use case.
• Put autonomous identities into lifecycle governance Add AI agents to the same inventory, review, and offboarding discipline used for other non-human identities, including periodic attestation and revocation when the agent is no longer needed.

Key takeaways

• AI agents behave like identities because they act through credentials, tokens, and delegated access, not just through application logic.
• Discovery is only useful when it produces ownership, scope, and lifecycle context that can be governed over time.
• The control gap is not visibility alone, but whether autonomous systems are brought under inventory, review, and offboarding discipline.

Key terms

• AI Agent Inventory: A continuously updated record of AI agents operating in an environment, including owner, purpose, access scope, and credential type. It is more than an asset list because it connects behaviour to accountability, which is what makes the identity governable over time.
• Shadow AI: Undiscovered or unmanaged AI agents that operate without formal review, ownership, or lifecycle oversight. In practice, shadow AI creates untracked access paths that can persist long after the business need that created them has changed.
• Programmatic Identity: A non-human identity used by software to authenticate and access systems through tokens, API keys, OAuth grants, service accounts, or certificates. For AI agents, the identity may be technically valid while the behaviour attached to it becomes harder to predict and govern.
• Identity Blast Radius: The range of systems, data, and workflows reachable through a single identity or credential path. For AI agents, blast radius expands when one delegated identity can chain multiple tools or services before any human review occurs.

What's in the full article

Token Security's full blog covers the operational detail this post intentionally leaves for the source:

• Step-by-step discovery inputs across SaaS, cloud, code repositories, and runtime telemetry for locating AI agents.
• Practical examples of naming, tagging, and log sources that help distinguish agents from ordinary automation.
• A structured approach to prioritising discovered agents by business ownership, crown-jewel access, and risk.
• FAQ examples showing how the vendor frames agent inventory, shadow AI, and unmanaged access in practice.

👉 Token Security's full post covers the discovery stages, risk context, and lifecycle approach in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.