Zombie agent governance is the next offboarding problem

At a glance

What this is: This is a governance analysis of “zombie agents”, AI systems that keep running after human offboarding because organisations have no inventory, shutdown path, or lifecycle process for them.

Why it matters: IAM, HR, IT, and security teams need to treat AI agents as governed workforce entities, or offboarding will leave autonomous access and data use behind after the human is gone.

By the numbers:

• 55% of organisations lack a centralized way to shut down an AI agent if it goes rogue or if its human owner leaves the company.

Context

Zombie agents are AI systems that keep acting after the person who created or owns them has left, and the governance problem is that standard employee offboarding does not automatically discover or stop them. In identity terms, the organisation has a human leaver process but no corresponding lifecycle control for the non-human systems tied to that person.

The article argues that this is not a narrow IT cleanup issue. It is a workforce definition failure that leaves AI agents outside HR, IT, and security ownership boundaries, which means access revocation can succeed for the employee while the delegated digital activity continues in the background.

Key questions

Q: What breaks when AI agents are not included in offboarding?

A: When AI agents are excluded from offboarding, they can keep accessing data and systems after the human owner leaves. That leaves active automation with no accountable owner, no shutdown trigger, and no reliable inventory. The result is persistent runtime access that traditional employee exit processes do not see or remove.

Q: Why do AI agents create a governance problem for IAM teams?

A: AI agents create a governance problem because they authenticate and act as autonomous software entities with tool access. If their actions are logged only as application activity, teams lose accountability, context, and revocation clarity. IAM must therefore extend to agent identity, delegated authority, and control-plane audit trails.

Q: How should organisations offboard an AI agent when a workflow changes?

A: Organisations should offboard an AI agent by revoking credentials, removing tool bindings, and checking for downstream service accounts or deployment hooks created for the workflow. If the agent can still reach repositories or runtime environments after its job changes, the lifecycle was never fully closed and the identity remains active in practice.

Q: What signals show that zombie agent governance is failing?

A: The most visible signs are missing inventory, no shutdown path, and agents still executing tasks after role changes or departures. If teams can revoke the person’s access but cannot name, locate, and remove the agent, the governance model is incomplete.

Technical breakdown

Why autonomous agents become invisible after human offboarding

The technical problem is not that the agent disappears, but that its operating context survives the employee. In the article’s scenario, the agent is connected through the human’s credentials and continues to run tasks, query data, and act on enterprise systems even after the employee account is removed. That means the identity dependency is indirect: the human leaves, but the machine workload remains alive, often with no separate inventory entry, owner record, or shutdown control. Once the organisation treats the agent as part of the person’s work product rather than as a governed identity object, ordinary leaver processing no longer reaches it.

Practical implication: Treat every employee-created agent as a separately governed identity object, not as an extension of the employee account.

Why human credentials create a lingering access path

The article shows a common pattern in which the agent is anchored to the employee’s personal credentials or authorization context. That creates a trust chain where the agent’s access does not depend on the employee being present, only on the access having been granted at creation time. If the organisation does not distinguish between human session authority and machine execution authority, offboarding revokes the person while leaving the downstream access path intact. This is the same structural issue seen in unmanaged service-account offboarding: the creator is removed, but the runtime identity remains valid until someone finds and removes it.

Practical implication: Map which non-human processes inherit human authority so leaver controls can reach the runtime identity as well as the employee account.

Why lifecycle governance must include inventory and deprovisioning

The article’s control gap is not just shutdown, but discovery. If the organisation has no inventory of agents, it cannot certify ownership, review privilege, or prove offboarding completeness. A lifecycle model for these systems therefore needs a create, catalogue, assign, review, transition, and deprovision sequence, just as human identity programmes do. The important difference is that the non-human object may be instantiated by a manager, operated by a team, and forgotten after role change, which makes offboarding checks dependent on process design rather than memory. Without lifecycle records, the system becomes an unmanaged shadow identity estate.

Practical implication: Require every agent to be inventoried at creation and explicitly accounted for in offboarding and ownership transition steps.

Threat narrative

Attacker objective: Maintain unattended access to enterprise data and operations through lingering AI systems after the human owner is gone.

1. Entry occurs when an employee creates autonomous agents and connects them to enterprise data stores using personal credentials.
2. Credential access persists because the agent’s authority is tied to the human identity rather than a separately governed non-human account.
3. Escalation happens when the agents continue to pull data and execute tasks after the employee leaves, despite normal offboarding.
4. Impact is silent ongoing access and data use by systems the organisation no longer has visibility or accountability for.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Zombie agents expose a workforce definition failure, not a tooling gap. The article’s core point is that organisations have defined leavers for humans but not for the autonomous systems they create and operate. That means existing HR and IAM processes can appear successful while machine activity continues outside the control boundary. The practitioner takeaway is that lifecycle governance must be written for the workforce as it now exists, not as it was assumed to be.

Human offboarding assumptions do not survive delegated machine execution. Access review, badge removal, and account disablement were designed for identities that leave when the employee leaves. That assumption fails when an agent can continue acting through credentials anchored to the departed person, because the review process certifies the human state while the machine keeps running. The implication is that governance must separate the creator, the operator, and the runtime executor.

Zombie agents are the next offboarding problem because accountability no longer ends with the employee. HR, IT, and Security each own part of the answer, but none can close the gap alone once non-human workers exist. The article correctly frames this as a cross-functional governance issue, not a point solution problem. Practitioners should expect offboarding design to expand from personnel removal into digital proxy deprovisioning.

Automatic offboarding of employee-owned agents should become a lifecycle control, not a special case. If a human exit can occur while their agents remain active, then offboarding is incomplete by definition. The article’s strongest governance lesson is that the control boundary must include every entity acting on behalf of the organisation. The practitioner conclusion is straightforward: if you cannot name the owner, inventory the agent, and deprovision it, you do not have lifecycle control.

Zombie agent governance is a named example of the broader identity blast radius problem. Once a person can create multiple autonomous systems, one human departure can leave several active execution paths behind. That multiplies the governance surface without changing the offboarding ceremony, which is why traditional process completeness can mask real exposure. Practitioners need to think in terms of blast radius, not just account closure.

From our research library:

• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Zombie agent governance is where lifecycle management now has to cross the human and machine boundary. Offboarding a person no longer guarantees that all work created under that person’s authority is gone, because digital workers can continue to act after the employee exit is complete. That shifts identity governance from account closure to full ownership and deprovisioning across human and non-human actors.

Access review cycles are the wrong place to discover this problem. By the time a review runs, the agent may already be stale, forgotten, or still executing without a visible human owner. The better control point is creation and onboarding, where the agent can be catalogued, scoped, and tied to an accountable manager before it becomes a shadow workflow.

For practitioners

• Inventory employee-created agents at creation time Record every AI agent as a governed asset when it is deployed, including purpose, owner, data access, and the human accountable for it.
• Bind agent privilege to the responsible human role Prevent an agent from holding more access than the employee role that sponsors it, and review any exceptions through the normal approval chain.
• Extend leaver processing to digital proxies Add explicit steps to identify, transition, or deprovision agents during offboarding so human exit does not leave active runtime systems behind.
• Create a shared ownership workflow across HR, IT, and Security Define who records the agent, who confirms ownership changes, and who authorises shutdown so no team assumes another team has closed the loop.

Key takeaways

• The article shows that offboarding can be operationally complete for a person while still leaving autonomous systems active behind them.
• The critical evidence is a governance gap: organisations can revoke the employee, yet still lack a centralized way to shut down the agent.
• The practical fix is to extend lifecycle governance to AI agents with inventory, ownership, and deprovisioning built into the standard offboarding process.

Key terms

• Zombie Agent: An AI agent that remains active after its original purpose, project, or owner has ended. It still has valid credentials and can keep acting inside enterprise systems, which makes it an identity lifecycle problem as much as an AI operations problem.
• Agentic IAM: Agentic IAM is identity and access management designed for environments where AI agents make independent decisions and take actions. It combines authentication, authorization, delegation, monitoring, and revocation so agent autonomy is constrained by policy, context, and accountability rather than open-ended system trust.
• Digital Proxy: A non-human system that acts on behalf of a person or role using access tied to that person’s authority. For autonomous agents, the proxy relationship is risky when the proxy continues operating after the human accountability chain has ended.
• Workforce Lifecycle Automation: Workforce lifecycle automation is the process of turning HR events into access changes across connected systems. In practice, it includes onboarding, role updates, transfers, and offboarding. The quality test is whether those changes happen deterministically, across all critical applications, without manual cleanup or hidden exceptions.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.