Topic starter
24/09/2026 1:27 pm
TL;DR: C1.ai shows that AI agents authenticate through API keys, OAuth grants, and delegated tokens, then look like service accounts in logs until their behaviour diverges. The governance gap is discovery and ownership, because agents created outside IT bypass the inventory paths built for humans and traditional NHI controls.
Editorial analysis by NHI Mgmt Group, based on content published by C1.ai: “You Can't Govern the AI Agents You Can't Find”.
Key questions
Q: How should security teams discover AI agents that are not in IAM inventories?
A: Use multiple discovery paths at once: declared agent registries, repository scanning, plugin and app store monitoring, network analysis, and identity analytics.
Q: Why do AI agents and service accounts create the same governance problem?
A: Both act as non-human identities with execution authority, and both can be abused once permissions are too broad or insufficiently monitored.
Q: What are the signs that an AI agent is already in the environment?
A: Common signs include OAuth apps with broad scopes, long-lived API keys tied to orchestration tools, identities that suddenly access unrelated systems, and creation records tied to project teams rather than central IAM.
Practitioner guidance
- Map agent creation pathways Trace where AI agents are being created outside the IdP, cloud account, or secrets platform, especially in low-code tools and application-team workflows.
- Correlate credential patterns and behaviour Look for OAuth apps with broad scopes, long-lived API keys, and identities that touch multiple unrelated systems in short windows.
- Assign durable ownership Attach each discovered agent to a team or role with a named accountable individual so turnover does not orphan the identity.
Bottom line: AI agents are becoming a discovery and ownership problem because they can hide inside ordinary service-account telemetry until their behaviour changes.
What's in the full article
C1.ai's full article covers the operational detail this post intentionally leaves for the source:
- How AI agent discovery signals differ from standard service-account inventory checks
- Why ownership assignment needs to survive team turnover and not just initial provisioning
- How agents created in low-code and application-team workflows escape central IAM visibility
- How to think about agent-speed governance when review cycles are slower than agent creation
👉 Read C1.ai's analysis of AI agent discovery and ownership in identity governance →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
24/09/2026 1:27 pm
AI agent discovery is now a governance prerequisite, not a hygiene task. The central failure is not that organisations lack another inventory spreadsheet. It is that application teams can create agent identities outside the control paths built for human and traditional NHI onboarding. Once that happens, recertification, ownership, and offboarding all start from an incomplete map, which means the governance programme is already behind the risk.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations assign ownership for AI agents in production?
A: Assign ownership to a named business and technical accountable party before the agent is allowed to act. The owner must be able to approve scope, review behaviour, and respond to exceptions. If the name on the record cannot influence the agent's access or operating rules, the ownership control is not real governance.
👉 Read our full editorial: AI agent discovery is the missing layer in identity governance