Lineage-aware IAM is exposing ghost agents and hidden data reach

At a glance

What this is: This analysis says traditional IAM can verify entitlements but still miss the sensitive data that human and non-human identities can actually reach through chained access.

Why it matters: It matters because IAM, IGA, and PAM teams need to govern reachable exposure, not just assigned permissions, especially where service accounts and AI agents inherit broad access.

By the numbers:

• 97% of non-human identities carry excessive privileges, according to Entro Security's 2025 research.

👉 Read Sentra's analysis of lineage-aware IAM and ghost agents

Context

Lineage-aware access mapping is the missing control layer when IAM can tell you who or what has access, but not what sensitive data becomes reachable through inherited, chained, or multi-hop permissions. In practice, that means service accounts, AI agents, and dormant credentials can preserve exposure long after the original business purpose has disappeared.

That gap is especially visible in environments where AI agents inherit the permissions of the identities they run under. A quarterly review can confirm the role exists, yet still fail to show the real exposure path into customer or operational data, which is why ghost agents and stale service accounts are governance problems, not just inventory problems.

Key questions

Q: What breaks when IAM only reviews permissions and not data reachability?

A: Teams can approve a role or service account while still missing the sensitive data it can reach through pipelines, inheritance, or downstream systems. That creates false confidence, because the entitlement looks legitimate even when the actual exposure is broader than the business use case. Reachability, not permission alone, is the governance boundary that matters.

Q: Why do ghost agents increase NHI risk more than ordinary dormant accounts?

A: Ghost agents are risky because they remain authenticated, can still hold live access, and often sit outside normal human lifecycle cues like leave events or recertification prompts. They are abandoned by process, not by malice, which means nobody is watching them even though they may still reach sensitive data.

Q: How can security teams tell whether an identity is actually overexposed?

A: Look for identities whose permitted path reaches regulated or customer data through multiple systems, even when the direct role assignment seems modest. If the access review cannot explain the full chain from identity to sensitive data, the identity is overexposed in practice. A reachable-data map is the clearest signal.

Q: Should organisations treat agent access reviews the same as human access reviews?

A: No. Human reviews focus on role, business need, and employment status, while agent reviews must also cover tool scope, credential inheritance, and downstream action paths. The review object is not just the agent itself but the full execution chain it can initiate. That distinction matters because agent behaviour can change faster than a standard recertification cadence can capture.

Technical breakdown

Why permission-based IAM misses reachable data

Traditional IAM records entitlement state, meaning it answers whether an identity can read a resource, not what the resource contains or what else becomes reachable through downstream processing. That is adequate for coarse access governance, but it breaks when data moves across Snowflake, Databricks, object storage, and agent-facing retrieval layers. In those chains, the final risk is not the first permission grant, but the full path from identity to sensitive data.

Practical implication: map identity access to actual data exposure paths, not just role assignments or resource-level grants.

What ghost agents change in NHI governance

Ghost agents are dormant or abandoned AI agents that remain authenticated and still hold whatever access was granted during development or testing. They are not malicious by default, which is precisely why they are dangerous: nobody is monitoring them the way a human account would be monitored, and they do not trigger ordinary lifecycle cues such as leave events or recertification prompts. The control problem is persistence without active ownership.

Practical implication: add decommission and ownership checks for AI agents and service identities that no longer have an active business task.

How lineage-aware access mapping closes the gap

Lineage-aware access mapping traces the path from identity to entitlements to the actual sensitive data reached through those entitlements. Instead of reviewing each hop independently, it correlates business context and data sensitivity so security teams can see when a seemingly harmless identity can surface regulated or customer data several steps downstream. That changes the question from whether access exists to whether exposure exists.

Practical implication: build reviews around end-to-end reachability, especially for multi-hop analytics and agentic workflows.

Threat narrative

Attacker objective: The objective is to preserve persistent, low-visibility access to sensitive data paths that appear harmless in ordinary IAM reviews.

1. Entry begins when a service account, API key, or AI agent is granted access during a project build and is never fully decommissioned after the work ends.
2. Escalation happens when that identity inherits broader data reach through chained pipelines, cross-system entitlements, or reused service principals.
3. Impact is the continued reachability of sensitive data by a dormant or low-visibility identity, creating exposure that standard permission reviews miss.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Lineage is now the decisive control gap in IAM. Permission review still matters, but it is no longer enough to prove security when identities can reach sensitive data through chained systems and inherited access. The discipline has shifted from asking who can read a resource to asking what that identity can actually expose in context. Practitioners should treat reachable data as the real unit of governance.

Ghost agents create a distinct lifecycle failure mode. They sit between dormant service accounts and active AI workflows, which means they can outlive the project that created them without ever appearing in a normal human offboarding process. That is not just an inventory problem. It shows that lifecycle governance must cover machine and agent identities with the same seriousness as human joiner-mover-leaver controls.

Excess privilege becomes more dangerous when the identity can act at machine speed. Entitlements that are merely broad in human workflows become materially riskier when an AI agent can summarise, cross-reference, and surface everything reachable through them in seconds. OWASP's agentic guidance is relevant here because the risk is not only access abuse, but the amplification of reach once an autonomous or semi-autonomous system holds that access. Security teams should re-evaluate where task scope ends and data exposure begins.

Lineage-aware access mapping names a concept the market has been missing. It captures the difference between assigned permission and actual exposure, which is the blind spot behind many overconfident access reviews. The implication for IAM, IGA, and PAM teams is straightforward: if you cannot trace the path to sensitive data, you cannot credibly claim the identity is safely governed.

The strongest governance assumption to retire is that review cadence equals control. Quarterly recertification was designed for slower-moving identities and stable business roles. That assumption fails when AI projects connect new data sources on sprint timelines or when dormant credentials remain live for years. The implication is that review cadence must give way to continuous reachability analysis.

From our research:

• 97% of non-human identities carry excessive privileges, according to the 2026 Infrastructure Identity Survey.
• From our research: 59.8% of organisations see value in a solution that simplifies non-human access management and introduces dynamic ephemeral credentials, according to The 2024 Non-Human Identity Security Report.
• For a broader control lens, see the NHI Lifecycle Management Guide for provisioning, rotation, offboarding, and visibility patterns that limit long-lived exposure.

What this signals

Lineage-aware access mapping will become a core governance pattern for programmes that run mixed human, machine, and agent identities. Once teams stop measuring only assigned access and start measuring reachable exposure, stale review logic becomes visibly inadequate. The shift is not cosmetic; it changes how IAM, IGA, and PAM teams prioritise remediation and ownership.

The practical signal for practitioners is that lifecycle and governance must converge. When a dormant service identity or ghost agent still reaches sensitive data, the question is no longer whether the role was approved, but whether the access path is still justified. That is why continuous reachability review should sit alongside the NHI Lifecycle Management Guide and related identity governance processes.

As AI adoption expands, the programme risk is not simply more identities. It is more identities connected to more data sources on shorter timelines, which means exposure can outrun quarterly governance cycles. Teams that can trace data reach in near real time will be better positioned than those relying on periodic attestation alone.

For practitioners

• Inventory dormant service identities and ghost agents Search for non-human identities that still authenticate but no longer have a current business owner, active project, or documented purpose. Prioritise identities with access to customer, financial, or regulated datasets, and treat unexplained persistence as a lifecycle defect rather than a housekeeping issue.
• Map reachable data, not just assigned permissions Trace each identity from its role or service principal through pipelines, storage, and retrieval layers to the sensitive data it can actually surface. Use that map to separate harmless access from exposure that could become material in a single hop or multi-hop chain.
• Add decommission triggers for AI agents and service accounts Require explicit offboarding when a project ends, a data source changes, or an identity has not executed a validated business task within its intended lifecycle. If no owner can explain the access path, revoke it and document the exception before restoring anything.
• Move recertification toward continuous reachability checks Keep periodic access reviews, but back them with continuous checks that detect new downstream data reach, especially where agent workflows or analytics pipelines change faster than the review cycle. The goal is to catch exposure when the path changes, not months later.

Key takeaways

• IAM can confirm entitlement state without revealing the true exposure path, which is why lineage matters more than permission lists alone.
• Ghost agents and dormant service identities are lifecycle failures, not just inventory mistakes, because they can preserve live access long after the work ends.
• Security teams need reachability-based governance, continuous ownership checks, and decommission discipline to control non-human identity exposure.

Key terms

• Lineage-Aware Access Mapping: A governance method that traces an identity from its entitlement to the actual sensitive data it can reach through downstream systems. It moves beyond permission lists and shows the real exposure path, which is essential when service accounts and AI agents inherit access across multiple hops.
• Shadow Agent: An AI agent deployed without formal registration, identity governance, or security oversight — the agentic equivalent of shadow IT. Shadow agents are more dangerous than typical shadow NHIs because they actively take actions using their credentials.
• Identity-Reachable Exposure: Identity-reachable exposure describes a vulnerability or control weakness that can be accessed through a real identity path, such as a service account, API key, token, or workload credential. It is a useful way to connect application risk to the identities that can actually trigger or abuse it.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full article

Sentra's full article covers the operational detail this post intentionally leaves for the source:

• Lineage-aware access mapping examples that trace identity reach across Snowflake, Databricks, S3, and agent-facing retrieval layers
• The article's practical framework for distinguishing assigned access from actually reachable sensitive data
• Specific examples of ghost-agent style exposure and how the vendor proposes to surface them in live environments
• The way Sentra maps human and machine identities to sensitive data reach in practice

👉 Sentra's full article covers reachable-data mapping, ghost agents, and the limits of permission-only reviews.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.