TL;DR: AI agents often surface as programmatic identities tied to OAuth, API tokens, or service accounts, and Token Security argues that discovery must combine platform logs, credential data, and ownership context to make them governable. The real issue is not just visibility but the collapse of assumptions that access, intent, and accountability remain stable enough for conventional IAM and review cycles.
At a glance
What this is: This is Token Security’s analysis of why AI agent discovery has become an identity governance problem, with the core finding that autonomous systems often look like ordinary programmatic identities until teams correlate logs, credentials, and ownership.
Why it matters: IAM, IGA, and security teams need a way to inventory AI agents before over-permissioned, orphaned, or shadow identities create ungoverned access paths across SaaS, cloud, and internal systems.
Context
AI agent discovery is the process of finding software identities that act on behalf of people or business units, then linking them to the credentials, systems, and ownership that make them governable. The problem is not just that these identities are hard to spot. It is that they often sit inside existing IAM and cloud structures without a clean boundary between human intent and machine execution.
Token Security’s article frames the issue as a governance gap created by autonomous systems that use OAuth grants, API tokens, service accounts, and telemetry across SaaS, cloud, and code pipelines. For identity teams, the practical challenge is building an inventory that captures both technical access and business accountability before shadow AI becomes normalised.
Key questions
Q: What breaks when AI agents are not inventoried or classified?
A: When AI agents are not inventoried or classified, organisations lose the ability to assign risk, apply the right obligations, and prove control to auditors. The result is hidden access, inconsistent oversight, and weak accountability when the agent touches regulated data or triggers business actions.
Q: When do autonomous systems create more governance risk than ordinary automation?
A: They create more risk when they can decide the action sequence, choose tools at runtime, and execute without human approval. At that point, the system is no longer following a fixed script. The governance challenge shifts from workflow management to controlling independent action inside a session.
Q: How do you know if AI discovery is actually working?
A: AI discovery is working when the organisation can produce one authoritative inventory, classify tools consistently, and explain which data and permissions each tool can reach. If the team still has to switch between dashboards or cannot map runtime usage back to policy, discovery is incomplete even if coverage looks broad.
Q: What should organisations do first after discovering unmanaged AI agents?
A: Organisations should first isolate the credentials, tool connections, and data paths attached to the unmanaged agent before expanding use further. Then they should decide whether the system is approved, remediated, or retired. That sequence limits hidden authority and reduces the chance of an unseen workflow becoming an attack path.
Technical breakdown
How AI agents hide inside ordinary programmatic identities
AI agents frequently inherit identity patterns that already exist in enterprise environments. They may authenticate through OAuth grants, service accounts, access tokens, or API keys, so they look operationally similar to scripts and workloads even when they behave more flexibly. The technical challenge is correlation: platform logs, credential stores, cloud audit trails, and application telemetry each reveal part of the picture, but none is sufficient alone. Discovery therefore becomes a multi-source identity matching problem, not a simple asset scan. Practical implication: teams need to correlate usage signals with ownership and purpose before an AI identity can be governed.
Practical implication: correlate platform logs, credential data, and ownership records before treating an AI agent as governed.
Why inventory needs ownership context, not just visibility
An AI agent inventory is not a static asset list. It is a governance record that should capture who created the agent, what it touches, which credentials it uses, and whether its permissions still match its purpose. Without that context, a discovered agent can still be effectively invisible from a control perspective because no one can attest to why it exists or who should offboard it. That is what makes discovery different from traditional asset management. Practical implication: inventory design must include ownership, purpose, access scope, and operational status as first-class fields.
Practical implication: build the inventory around ownership, purpose, access scope, and operational status rather than host or app metadata alone.
What turns discovery into governance for autonomous systems
Discovery only becomes governance when it feeds lifecycle controls. For AI agents, that means linking detected behaviour to entitlement review, privilege right-sizing, monitoring baselines, and offboarding triggers. The article’s strongest point is that autonomous systems do not wait neatly for review cycles, so identity governance has to move earlier in the chain, closer to issuance and correlation. In other words, the inventory is the control surface, not the report. Practical implication: if an AI identity cannot be tied to a responsible owner and a current business purpose, it is not yet governable.
Practical implication: connect discovery to lifecycle controls so unmanaged AI identities can be reviewed, scoped, monitored, and removed.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Autonomous identity discovery is really a lifecycle governance problem: AI agents do not become governable simply because they are visible in logs. They become governable only when discovery links runtime signals to ownership, purpose, and entitlement scope. That shifts the control question from "can we find it?" to "can we assign and enforce accountability before it drifts?" The practitioner conclusion is that inventory quality determines whether autonomous identity can be governed at all.
Access review processes assume identities stay stable long enough to be reviewed: That assumption was designed for standing accounts and periodic certification cycles. It fails when the actor is autonomous because access can be created, used, and abandoned inside a single operational sequence. The implication is not just faster review, but a rethink of where governance starts, because the review artefact may never exist in time.
Identity blast radius becomes the more useful concept than identity volume: The article shows that the problem is not how many AI agents exist, but how far each one can reach once linked to cloud, SaaS, and internal systems. A small number of over-permissioned agents can create a larger governance exposure than a broad population of low-impact ones. The practitioner conclusion is to prioritise the agents that touch crown-jewel data and production systems first.
Shadow AI is an offboarding failure as much as a discovery failure: If an autonomous identity is undocumented, it cannot be retired cleanly when the business purpose changes. That creates persistence beyond intent, especially when credentials are embedded in code, vaults, or platform integrations. The practitioner conclusion is that discovery and decommissioning must be treated as one lifecycle problem, not two separate workflows.
AI agent governance will converge with NHI lifecycle controls before it converges with human IAM practice: The strongest parallels are with service accounts, tokens, and other non-human identities because the operational questions are the same: who owns it, what can it reach, and when should it be removed. Human IAM still matters for accountability, but the control mechanics are machine-like. The practitioner conclusion is to anchor AI agent governance in NHI lifecycle discipline, then extend upward to human ownership.
From our research library:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- Read next: AI Agent Authorisation Guide
What this signals
AI agent discovery fails when teams treat runtime visibility as inventory: Logs can show that an agent acted, but they rarely explain who owns it, why it exists, or whether its access still matches its purpose. That is why discovery has to feed governance records, not just detection tooling.
Identity blast radius is the better planning lens than agent count: A small number of autonomous identities with broad SaaS or cloud reach can create more governance exposure than a large population of low-impact automations. Teams should rank agents by business criticality, credential scope, and how far they can move across systems.
70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey. That gap is exactly why discovery must be tied to entitlement right-sizing, not just asset enumeration.
For practitioners
- Map agent discovery inputs across the stack Correlate SaaS audit logs, cloud trails, OAuth grant records, API gateway events, and secret store usage to surface AI agent identities that are otherwise hidden in normal application traffic.
- Add ownership and purpose to every discovered agent Record the creator, business owner, intended purpose, active credentials, and current status for each AI agent so the inventory can support governance decisions rather than just visibility.
- Right-size permissions against actual agent behaviour Compare observed access patterns with stated purpose, then remove excess entitlements that let an AI agent reach production data or other crown jewels beyond its need.
- Build offboarding into the discovery workflow Treat undocumented or orphaned AI agents as lifecycle risks and define a removal path for credentials, integrations, and pipeline references when the business use no longer exists.
Key takeaways
- AI agent discovery is a governance discipline, not a pure visibility exercise, because ownership and purpose must be known before an autonomous identity can be controlled.
- The main risk is not only that AI agents exist, but that they operate with credentials and access that teams cannot cleanly attribute, review, or retire.
- Discovery should feed entitlement reduction, inventory hygiene, and offboarding so autonomous identities do not accumulate ungoverned reach over time.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Undocumented AI agents become governance problems when they are not cleanly retired. |
| NHI-05 — Overprivileged NHI | The article highlights AI agents granted more access than their actual purpose requires. | |
| NHI-09 — NHI Reuse | AI agents often reuse service accounts, OAuth grants, and tokens across systems and workflows. | |
| Recommendation — Treat undiscovered AI agents as offboarding risks and remove their credentials, integrations, and access paths promptly. Right-size AI agent entitlements to the minimum access needed for the stated business purpose. Track reused credentials and shared identities so one agent does not silently inherit another's access scope. | ||
| MITRE ATT&CK | TA0006;TA0007 — Credential Access; Discovery | The article centres on finding and understanding identity and credential usage patterns across environments. |
| Recommendation — Map discovery telemetry and credential usage to TA0006 and TA0007 to prioritise exposed AI identities. | ||
| NIST CSF 2.0 | ID.AM-01 — Physical Devices and Systems Inventoried | Discovery and inventory are the article's core governance mechanisms for AI identities. |
| Recommendation — Extend inventory practices to AI agents so ownership, access, and status are recorded consistently. | ||
Key terms
- AI agent inventory: An AI agent inventory is a complete record of autonomous or semi-autonomous software entities, including their permissions, tools, and reachable resources. It is a governance baseline because teams cannot review, restrict, or remediate agent access until they know exactly what the agent estate contains.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Ownership Context: The information that tells a security team who is responsible for a system, repository, identity, or change. Without it, triage turns into guesswork and controls cannot be assigned, prioritised, or remediated with confidence.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on July 6, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org