Topic starter
24/06/2026 6:57 pm
TL;DR: Employee-built agents are already operating inside enterprises with broad access, unclear ownership, and little oversight, and Aizome argues that BYOA creates a governance gap larger than the earlier BYOD problem. The issue is not just more automation but a control model built for static devices facing runtime-adapting actors that reason and act independently.
Editorial analysis by NHI Mgmt Group, based on content published by Aizome: “Meet BYOA: The Shadow AI Agent Problem That Makes BYOD Look Simple”.
By the numbers:
- Only 24% of organisations have full visibility into which AI agents are communicating with each other, according to Aizome.
- The average enterprise now manages 37 deployed agents, according to Aizome.
Key questions
Q: What breaks when employee-built agents are deployed without inventory or ownership?
A: The governance chain breaks first.
Q: Why do BYOA agents create more risk than BYOD devices did?
A: Because the risk is not only the object entering the enterprise, it is the actor changing its behaviour at runtime.
Q: How do security teams know if an AI agent is operating outside its approved role?
A: Teams should compare actual workflow behaviour against the approved use case.
Practitioner guidance
- Build an enterprise agent inventory Discover every employee-built or team-built agent, assign an owner, record its integrations and keep the inventory continuously updated.
- Map agent trust chains Trace how each agent inherits permissions, upstream workflow context and delegated access across ERP, CRM, ticketing and cloud systems.
- Move governance to runtime checks Validate agent actions against expected behaviour, not just approved entitlements, so scope drift is visible while the agent is active.
Bottom line: BYOA is an identity governance problem, not just an automation trend, because employee-built agents already operate across enterprise systems with unclear ownership and runtime-changing access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:00 am
BYOA exposes an identity governance model built for stable subjects, not runtime-adapting actors. The article is right to frame this as larger than BYOD because the underlying assumption is different: devices stay what they are, while agents change what they can do from task to task. That means the enterprise is not only managing access, it is managing behaviour under delegation. Practitioner implication: governance for agents has to move from static approval to runtime accountability.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
- 76% of organisations cite shadow AI as a definite or probable problem, up from 61% in 2025, according to HiddenLayer's 2026 AI Threat Landscape Report.
A question worth separating out:
Q: What should organisations do when an agent inherits access through another workflow?
A: Treat that as a trust propagation problem, not a simple entitlements issue. Review the upstream workflow, the delegated context and the downstream systems the agent can now reach. If the inherited access cannot be explained and bounded, the agent should not keep those connections.
👉 Read our full editorial: BYOA exposes a larger governance gap than BYOD ever did