Topic starter
28/05/2026 11:37 am
TL;DR: AI agent sprawl, including shadow agents in browsers, endpoints, and SaaS applications, leaves enterprises unable to inventory or govern all non-human identities, according to SailPoint. Visibility is now the prerequisite for NHI governance because you cannot control access paths you cannot map.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “From blind spots to full-spectrum visibility with SailPoint”.
Key questions
Q: What breaks when AI agents are not inventoried or classified?
A: When AI agents are not inventoried or classified, organisations lose the ability to assign risk, apply the right obligations, and prove control to auditors.
Q: Why do shadow agents create a bigger risk than ordinary automation?
A: Shadow agents create more risk because their authority can expand quietly as teams adapt them to new tasks.
Q: How should security teams handle AI agent visibility?
A: Security teams must conduct an exhaustive discovery process to identify all deployed AI agents, both sanctioned and unsanctioned, across the organization.
Practitioner guidance
- Build a continuous AI agent inventory Track every agent across browser sessions, endpoints, SaaS applications, and major AI platforms so the governance record reflects runtime reality.
- Map ownership and access paths Connect each agent to a human owner, the machine identities it uses, its entitlements, and the sensitive data it can reach.
- Treat unidentified agents as governance exceptions Flag agents that cannot be tied to an owner or source system and route them into review before they accumulate standing access.
Bottom line: AI agent sprawl creates an inventory problem first and a policy problem second, because governance cannot operate on identities that remain undiscovered.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
28/05/2026 11:42 am
Visibility debt is now the first NHI governance failure mode: The article points to a control environment where AI agents exist faster than governance records are updated. That is not a monitoring problem alone. It is a structural identity gap, because any downstream control that depends on an inventory will fail when the inventory is incomplete. Practitioners should treat discovery as the prerequisite control that determines whether every other NHI process can operate at all.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations treat AI agents as NHI or as application automation?
A: They should treat them as governed non-human identities with application behaviour. That framing captures the need for identity, scope, lifecycle, and audit controls while still recognising that agents operate through APIs, tools, and workflows. Pure automation language hides the governance gap.
👉 Read our full editorial: AI agent visibility is now the first control for NHI governance