Topic starter
24/09/2026 1:27 pm
TL;DR: AI agents authenticate through API keys, OAuth grants, and delegated tokens, then appear in logs like service accounts until they behave differently, according to C1.ai. The governance gap is discovery and ownership, because agents created by application teams bypass the inventory paths built for human and traditional NHI controls.
NHIMG editorial — based on content published by C1.ai: You Can't Govern the AI Agents You Can't Find
By the numbers:
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
- Only 5.7% of organisations have full visibility into their service accounts.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: What breaks when AI agents are treated like standard human users?
A: You lose visibility into effective permissions, expected behaviour, and real blast radius.
Q: Why do AI agents require ownership as well as discovery?
A: Discovery tells you an agent exists, but ownership determines who can review it, offboard it, and answer for its actions.
Q: How should security teams discover AI agents that were never formally deployed?
A: Use identity and telemetry correlation to look for agents that authenticate, retrieve secrets, assume roles, or call APIs without a matching onboarding record.
Practitioner guidance
- Map agent discovery to a behavioural inventory Track API keys, OAuth grants, and delegated tokens that are tied to orchestration tools, then compare their runtime behaviour against known service-account patterns.
- Require durable ownership for every agent Assign each agent to a team or role backed by a named individual so that access reviews, offboarding, and incident response have a real human entry point.
- Add agent-specific discovery signals to your inventory process Include credential scope, multi-system behaviour, and creation context in the same discovery workflow so that agent identities are not hidden inside ordinary service-account records.
What's in the full article
C1.ai's full post covers the operational detail this analysis intentionally leaves for the source:
- Step-by-step discovery cues for identifying agent identities in logs and identity systems
- Practical ownership models for assigning agents to teams and accountable individuals
- The distinction between service account behaviour and AI agent behaviour in production environments
- Examples of how discovery, inventory, and review should work at agent speed
👉 Read C1.ai's analysis of AI agent discovery and ownership in identity governance →
AI agent discovery and ownership: what IAM teams are missing?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
24/09/2026 1:27 pm
AI agent discovery is now a distinct governance layer, not a subtask of NHI inventory. The article shows why traditional machine-identity registers are too static for systems that can change behaviour at runtime. A credential can tell you that access exists, but it cannot tell you whether the identity is a service account or an AI agent composing actions across systems. The practitioner conclusion is that discovery logic must move beyond inventory completeness and toward behavioural identity classification.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how quickly inventory gaps become governance gaps.
A question worth separating out:
Q: Should agent identities be governed inside the same lifecycle as human users and service accounts?
A: Yes, but not with the same assumptions. Agents need the same lifecycle disciplines, including review and offboarding, yet they must be governed through behaviour-aware discovery and durable ownership because their access patterns can change faster than human-centric review cycles.
👉 Read our full editorial: AI agent discovery is the missing layer in identity governance
