TL;DR: Oak's July 30 analysis shows homegrown AI agent governance breaks on shadow agent discovery, effective permission calculation, and accountable ownership, even when scripts can register agents and rotate credentials. The real failure is assuming a static registry can govern agents whose access, provenance, and reach change faster than review cycles can capture.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Oak's blog post: Homegrown AI agent governance breaks down when teams cannot reliably discover shadow agents, keep ownership current, or calculate what agents can actually reach.
Why it matters: IAM and IGA teams need governance models that account for AI agents as living identities, not just registered records, or risk reviews and remediation will miss the real blast radius.
By the numbers:
- The 2026 Identity Security Landscape survey counted 109 machine identities per human.
- 40% of machine identities already have access to organizational data.
👉 Read Oak's analysis of build versus buy for AI agent identity governance
Context
AI agent identity governance is the problem of discovering, owning, reviewing, and remediating access for agents that can act independently across systems. The control gap appears when teams rely on a registry or token list instead of source-of-truth discovery, because the estate changes faster than the inventory.
For AI agents, the governance question is not whether a script can store credentials. It is whether the programme can prove who an agent acts for, what it can actually reach, and whether excess access is removed where it lives.
Oak's analysis is typical of the current programme gap: many teams can document registered agents, but far fewer can govern shadow agents, effective permissions, and accountable ownership at scale.
Key questions
Q: What breaks when AI agent identity governance relies on a manual registry?
A: Manual registries miss shadow agents, stale ownership, and changes made outside the recording path. The result is a governance view that looks complete on paper but cannot prove coverage in the systems where agents actually live. Teams should assume registry completeness is unproven until source-system discovery and reconciliation say otherwise.
Q: Why do AI agents create more risk when access is scoped once but not rechecked during execution?
A: AI agents can move through many steps in a single task, including prompts, retrieval, tool use, and output. If access is checked only at the start, the control assumes the original context still holds. That creates a gap where an agent can retrieve excess data, invoke the wrong tool, or expose information that was never safe for the final action.
Q: How should organisations decide whether to build or buy AI governance controls?
A: Choose build when the organisation needs deep custom instrumentation, strict data residency, and has dedicated engineering capacity to own the system long term. Choose buy when audit deadlines are close, governance coverage is needed quickly, or enforcement must be delivered faster than an internal team can build it. Hybrid approaches often work best for large enterprises.
Q: What should identity teams do when an AI agent leaves the original owner's control?
A: Treat that as an ownership and lifecycle event, not a minor metadata update. The agent needs a current accountable human, a fresh review of its effective permissions, and source-level removal of any excess access that no longer matches its purpose.
Technical breakdown
Why agent registries miss shadow identities
A registry only sees what someone chose to record, so it is a governance view, not an inventory guarantee. AI agents can be created in cloud consoles, SaaS tools, or bespoke workflows without passing through the same registration path, which means the control plane and the real estate drift apart. In identity terms, that creates an incomplete authoritative source: the system knows about declared agents but not necessarily about active ones. Practical governance has to start from discovery at the source systems, not from forms or spreadsheets. See the AI Agent Identity Security Buyer's Guide.
Practical implication: Treat source-system discovery as the baseline control, not registry maintenance.
Effective permissions are larger than declared scopes
Declared scopes tell you what a token says an agent may do. Effective permissions describe what the agent can actually reach through nested groups, inherited rights, impersonation chains, and connected systems. That distinction matters because risk lives in reachable resources, not in the permission string alone. For AI agents, effective access can be much broader than the original grant, especially when the agent runs on a builder's credentials or inherits privileges through delegation. Practical governance requires calculating the real reach of the identity, not just reading the token. See the AI Agent Authorisation Guide.
Practical implication: Review effective reach, not only assigned scopes, before certifying access.
Why ownership must be tied to the identity, not the creator
Ownership records decay as soon as people move teams or leave, which makes a static owner field a weak control for agent governance. A useful model keeps an accountable human attached to the agent as a living relationship, not a one-time form entry. That matters because AI agents can outlive the person who built them, and the business often continues to rely on them after the original context has gone. Practical governance depends on an ownership graph that is continuously maintained and auditable. Read Top 10 NHI Issues.
Practical implication: Maintain accountable ownership as a live relationship, not a static registry field.
Threat narrative
Attacker objective: The objective is to exploit unmanaged agent access to reach organisational data and systems without a trustworthy ownership or review trail.
- Entry occurs when an AI agent is created outside the governed registration path, often in a cloud console, SaaS tool, or ad hoc workflow.
- Credential access follows when the agent runs on the builder's credentials or a standing token that reaches more systems than intended.
- Escalation happens when nested groups, inherited rights, or impersonation chains expand the agent's effective permissions beyond the declared grant.
- Impact follows when the organisation cannot prove what the agent could access, who it acted for, or whether the excess access was removed at the source.
Breaches seen in the wild
- Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
- Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Shadow agent discovery is the first governance failure, not a secondary control gap: A homegrown inventory can only govern the agents someone remembered to register. That means the programme loses coverage exactly where risk is highest, in ad hoc agents created outside formal approval paths. The implication is simple: identity governance for agents starts with discovery from source systems, not with registration hygiene.
Effective permissions are the real blast-radius metric for AI agents: Declared scopes understate what an agent can reach when delegated access, inherited rights, and impersonation chains are in play. Oak's analysis is right to separate the token from the reachable estate, because governance decisions based on the former will miss the latter. Practitioners need a model that measures actual reach, not just assigned privilege.
Owner fields are not governance unless they stay current: A named owner at creation looks useful until the builder moves on and the agent outlives the record. That is why AI agent governance must treat ownership as a live accountability relationship, not a static metadata field. Otherwise, reviews certify an identity that no one can truly answer for.
Build-versus-buy is really a question about operational completeness: The build option can store secrets and record registrations, but it rarely keeps pace with new agent surfaces, changing vendor APIs, and audit-grade evidence demands. That creates a governance platform gap, not just an engineering burden. The practitioner test is whether the control can keep pace with the estate, not whether it can exist on day one.
Human, machine, and AI agent identities now belong in the same governance graph: Treating agents as a separate exception model creates parallel review processes, fragmented evidence, and inconsistent remediation. Oak's core point is that the same governance disciplines apply across people, workloads, and agents, but the identity objects differ. The ultimate guide to NHIs remains relevant here because the problem is still identity lifecycle control, even when the actor is an agent.
From our research library:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Read next: AI Agent Identity Security Buyer's Guide
What this signals
Continuous review becomes more important than periodic certification: AI agents can change reach faster than a calendar review can catch, so governance needs to move from scheduled certification to risk-triggered review. The control question is no longer whether access exists, but whether the system notices when an agent's effective permissions drift.
The next programme step is to converge agent governance with broader identity operations rather than creating a separate AI exception process. When human, machine, and AI agent identities share one graph, audit evidence, offboarding, and remediation become consistent instead of fragmented.
For practitioners
- Audit discovery coverage against source systems Map every agent source you rely on, including cloud consoles, SaaS platforms, homegrown workflows, and MCP-connected tools, then compare that list to what your current registry actually sees.
- Calculate effective permissions, not just declared scopes Trace nested groups, inherited admin rights, and impersonation chains to determine what each agent can truly reach before you approve or renew access.
- Tie each agent to a current accountable owner Replace static owner fields with a live mapping that updates when people change teams or leave, so review and remediation always have a responsible human.
- Remediate excess access at the source Remove overprivileged entitlements from the target system itself rather than closing a ticket and hoping another team acts later.
Key takeaways
- Homegrown AI agent governance fails when discovery, ownership, and effective access are managed as separate tasks instead of one lifecycle problem.
- The strongest evidence in the source points to scale, with 109 machine identities per human and 40% already accessing organisational data.
- Practitioners need source-system discovery and source-level remediation, or agent governance will remain incomplete no matter how good the registry looks.
Related NHI Mgmt Group resources: AI Agent Identity Security Buyer's Guide · AI Agent Authorisation Guide · AI Agent Observability, Audit and Incident Response Guide · Top 10 NHI Issues
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article centers on agents outliving their owners and governance records. |
| NHI-05 — Overprivileged NHI | Effective permissions routinely exceed declared scopes and need direct review. | |
| NHI-10 — Human Use of NHI | The post discusses agents acting on behalf of people and the need for attributable ownership. | |
| Recommendation — Track AI agent offboarding against NHI-01 and remove access when ownership changes or disappears. Apply NHI-05 to evaluate what each agent can actually reach, not just what its token states. Use NHI-10 to ensure every agent action can be traced to a current accountable human owner. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article discusses secrets, tokens, and lifecycle controls for AI agent credentials. |
| Recommendation — Apply IA-5 to govern credential rotation, revocation, and storage for AI agent authenticators. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The main governance issue is whether agent entitlements are accurate and enforceable. |
| Recommendation — Use PR.AA-05 to verify and constrain AI agent permissions against actual business need. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The threat narrative tracks credential abuse followed by expanded reach across systems. |
| Recommendation — Map unmanaged agent access to TA0006 and TA0008 when tracing how one identity can expand into broader reach. | ||
Key terms
- AI Agent Identity Governance: AI Agent Identity Governance is the set of policies, controls, and oversight used to manage how AI agents are identified, authorized, monitored, and retired. It defines who can create or operate an agent, what tools and data it may access, how its actions are logged, and how risk is reviewed across its lifecycle.
- Effective Permissions: Effective permissions are the access an identity can actually use after role inheritance, scope, and policy are applied. In Azure AI environments, they often matter more than the assigned role name because inherited rights can widen access to data, logs, and secret stores.
- Shadow Agent: An AI agent deployed without formal registration, identity governance, or security oversight, the agentic equivalent of shadow IT. Shadow agents are more dangerous than typical shadow NHIs because they actively take actions using their credentials.
- Accountable Owner: An accountable owner is the person or team that knows what business service, application, or process would break if a machine identity disappeared. This role is different from the governing function. The accountable owner provides operational context, objections, and approval boundaries when revocation or right-sizing is being considered.
What's in the full article
Oak's full blog post covers the operational detail this post intentionally leaves for the source:
- How ConnectAny reaches SaaS, homegrown, shadow, and custom agents through direct API, database, file, and on-prem connectors
- The line-by-line build-versus-buy comparison showing where homegrown scripts stop short on discovery, ownership, and remediation
- The evidence Oak says auditors and boards want to see, including inventory completeness and worst-case reachable access
- The review and remediation flow used to remove excessive permissions at the source rather than through ticket handoff
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on October 27, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org