Shadow AI governance fails when visibility stops at the perimeter

At a glance

What this is: This is an analysis of why blocking AI tools does not stop use, and the key finding is that shadow AI spans apps, extensions, OAuth integrations, and browser activity that perimeter tools miss.

Why it matters: It matters because IAM, NHI, and governance teams need visibility into identity-linked AI use, especially where personal accounts, OAuth grants, and emerging agentic browsers create unmanaged access paths.

By the numbers:

• Push telemetry shows that the average organization has 16 AI apps, 17 AI browser extensions, and 17 AI OAuth integrations in active use during a typical week.
• 80% of employees who use unapproved AI tools do so because it's easier to use their own accounts, and 57% because the approval process is too slow.

👉 Read Push Security's guide to shadow AI visibility, guardrails, and control

Context

Shadow AI is not a single tool problem, it is a visibility and governance problem. Once employees can reach AI services through personal accounts, browser extensions, and OAuth grants, blocklists at the perimeter stop describing reality and start hiding it. For IAM teams, the key issue is that identity-bearing access paths now exist outside the systems most organisations use to govern access.

The article’s primary point is that control only works when the governed path is more usable than the workaround. That makes shadow AI different from older shadow IT patterns because the activity often happens inside the browser, with identity context attached to each login, grant, and session. In practice, this is where AI governance meets identity governance and where unmanaged access becomes a non-human identity concern as agentic browsers enter the picture.

Key questions

Q: How should security teams govern shadow AI without blocking productivity?

A: Use visibility-based controls instead of blanket bans. Identify which tools are in use, who is using them, and what data they can access, then apply targeted policies by role and data sensitivity. That approach preserves legitimate AI adoption while reducing exposure from unsanctioned tools and unreviewed data paths.

Q: Why do personal accounts and OAuth grants make shadow AI a governance problem?

A: Because they turn a simple app choice into delegated access. A personal account can bypass corporate authentication controls, and an OAuth grant can give an AI tool persistent access to mail, storage, or code repositories. That means the real risk is not just use, but the access path created behind the use.

Q: What breaks when AI visibility is limited to SWGs, CASBs, or EDR?

A: Those tools usually miss browser-layer activity, which is where login method, prompt content, extension behaviour, and clipboard activity often occur. The result is partial evidence without the identity and data context needed for governance. Teams end up knowing a domain was visited, but not how the AI tool was actually used.

Q: Who should be accountable when departmental AI tools access sensitive systems?

A: Accountability should sit with the business owner, the platform owner, and the identity team together, because no single group can explain the full access chain alone. The owner must justify the access, security must constrain it, and IAM must be able to attest it. Without that shared model, governance becomes symbolic rather than operational.

Technical breakdown

Why perimeter controls miss shadow AI usage

Shadow AI usage often happens in the browser, not as a clean network transaction. SWGs and CASBs can see domains, but they usually cannot see whether a user logged in with SSO, reused a personal account, pasted source code into a prompt, or granted OAuth access to a corporate tenant. EDR sits below the browser layer, so it misses much of the interaction context. That means the control gap is not just enforcement, but observability: the security team can know a site was reached without knowing how identity, data, and access were actually used.

Practical implication: move AI governance telemetry closer to browser sessions and identity events, not only network logs.

How OAuth and browser extensions expand the trust boundary

Shadow AI becomes more dangerous when it connects to other systems. OAuth grants can create persistent API-level access to mail, storage, and code repositories, while browser extensions can request permissions that expose page content, browsing history, and clipboard data. Once these connections exist, one ungoverned AI app can become a pivot into the wider SaaS estate. This is why the issue crosses from application usage into identity governance, because the real risk is not just the app itself, but the delegated access it inherits.

Practical implication: inventory grants and extension permissions as part of access governance, not as a separate hygiene task.

What agentic browsers change in non-human identity governance

Agentic browsers are an emerging form of software-driven interaction that can authenticate to SaaS applications, access corporate data, and make API calls on behalf of users or workflows. That makes them closer to a non-human identity than a traditional browser session. They are not automatically autonomous, but they do create a governance problem because they can hold and exercise access without fitting neatly into human-centric identity processes. The control issue is lifecycle management for a new class of runtime actor.

Practical implication: define how agentic browsers are discovered, classified, approved, and offboarded before they become invisible access holders.

Threat narrative

Attacker objective: The attacker’s objective is to convert legitimate but ungoverned AI usage into delegated access, data exposure, or a foothold for lateral movement across business systems.

1. Entry occurs when employees adopt unapproved AI apps, personal accounts on approved tools, browser extensions, or OAuth-connected services outside governed channels.
2. Credential and authorization exposure follows when users grant AI tools access to mail, storage, code repositories, or paste sensitive data into prompts and chats.
3. Impact occurs when attackers abuse exposed credentials or delegated access, turning one unmanaged AI relationship into a pivot across the SaaS estate.

NHI Mgmt Group analysis

Shadow AI governance is an identity problem before it is an AI policy problem. The article shows that the hardest part of shadow AI is not choosing which tools to allow, but understanding who accessed what, under which identity, and through which authentication path. That makes the boundary between AI usage and IAM governance much thinner than many programmes assume. Practitioners should treat browser-layer identity signals as governance evidence, not as ancillary telemetry.

Browser visibility is becoming the missing control plane for AI adoption. Traditional perimeter tools were never built to observe prompt-level behaviour, personal-account login flows, or extension permissions inside the browser. That creates a browser-layer visibility gap where policy exists but enforcement cannot see the action that matters. For teams managing AI risk, the right question is no longer whether AI is blocked, but whether the control layer can actually observe and shape the user journey.

Delegated access is the real risk amplifier in shadow AI. Once an AI app or extension has OAuth access into email, storage, or development systems, the identity perimeter extends beyond the original login. This is where NHIs and agentic AI intersect with mainstream IAM, because the delegated actor can persist, expand, and behave outside the assumptions of human access review. Practitioners should classify AI integrations as governed access paths, not convenience features.

Agentic browsers create a new class of unmanaged runtime identity. When a browser can authenticate, retrieve data, and call APIs on behalf of a workflow, it starts to behave like a software identity with operational reach. That does not make it fully autonomous, but it does mean conventional user-centric governance will miss part of the access story. Identity teams should prepare now for discovery and lifecycle controls that can track these actors as they appear.

Shadow AI control has to be usable or it will fail. The article correctly identifies that users bypass controls when the governed path is slower or more frustrating than the alternative. That leads to a practical governance lesson: security policy must be paired with access experience design. If the sanctioned path is not easier, visibility alone will only document the workaround.

What this signals

Shadow AI is pushing identity programmes beyond account governance and into runtime behaviour governance. The practical shift is that security teams need evidence about how access is exercised inside the browser, not just whether an account exists. That makes browser telemetry and OAuth review part of the identity control stack, especially where corporate data can be transferred into AI systems without leaving the browser.

Browser-layer identity drift: once personal accounts, extensions, and delegated permissions become common, the governance problem is no longer whether AI is allowed but whether the organisation can still see the boundary of its own access. Teams should expect more demand for controls that classify AI usage automatically and surface unmanaged paths early. External guidance from the NIST SP 800-207 Zero Trust Architecture remains relevant because the assumption of implicit trust is exactly what shadow AI erodes.

For practitioners

• Build browser-layer AI visibility Instrument the browser session so you can see AI logins, personal-account use, clipboard activity, and extension permissions rather than relying only on perimeter logs.
• Treat OAuth grants as governed access Inventory AI-to-SaaS OAuth connections, review the downstream systems they can reach, and revoke grants that create persistent access without a clear business need.
• Classify agentic browsers as managed actors Create a control path for emerging autonomous browsers, including discovery, approval, and offboarding, so they do not remain invisible runtime identities.
• Replace block-only policy with guided enforcement Use monitor, warn, and block modes together so employees are steered toward approved AI tools before they choose workarounds.

Key takeaways

• Shadow AI is primarily a visibility failure, not a policy failure.
• OAuth grants, extensions, and browser sessions turn AI usage into identity-governed access paths.
• Security teams need guided enforcement and browser-layer telemetry or they will keep regulating the workaround instead of the work.

Key terms

• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Browser-layer visibility: Browser-layer visibility is the ability to observe user activity where it actually happens in the web session, including app use, input, consent, and extensions. For AI governance, it becomes the evidence layer that shows what employees used, what data they exposed, and what access they granted.
• OAuth Grant: An OAuth grant is the delegated permission an application receives to act on a user's behalf without storing the user's password. In NHI governance, it should be treated as a standing identity relationship with scope, ownership, and revocation requirements, not as a one-time setup detail.
• Agentic Browser: An agentic browser is a web browser with an embedded AI assistant that can interpret page content and take actions on the user’s behalf. It combines browsing, reasoning, and execution in one interface, which creates new governance requirements for identity, data handling, and approval boundaries.

What's in the full article

Push Security's full article covers the operational detail this post intentionally leaves for the source:

• Step-by-step browser discovery workflows for identifying shadow AI apps, extensions, and OAuth connections.
• Configuration detail for Monitor, Acknowledge, and Block enforcement modes across different user groups.
• Data-flow guardrails for clipboard, file upload, file download, and AI chat monitoring.
• Operational examples for detecting agentic browsers and unapproved MCP connections.

👉 The full Push Security post covers browser discovery, OAuth visibility, and enforcement modes in more operational detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and agentic AI identity. It helps practitioners connect identity controls to the broader security programme they already run.