Topic starter
12/06/2026 9:23 pm
TL;DR: AI adoption is accelerating faster than most identity programmes can classify, with 11% of organisations reporting formal agent production and 35% having no agentic strategy at all, according to JumpCloud findings cited from Deloitte and Gartner. The governance gap is now an identity problem, because unmanaged agents inherit human trust paths without human-scale controls.
Editorial analysis by NHI Mgmt Group, based on content published by JumpCloud: “The “Silicon Workforce”: Managing the Identity of AI Coworkers”.
Key questions
Q: What breaks when shadow AI is not included in identity governance?
A: When shadow AI is excluded, the organisation loses discovery, ownership, and enforcement at the same time.
Q: Why do unmanaged AI agents create a larger risk than managed ones?
A: Unmanaged AI agents are harder to audit, revoke, and contain because no one can reliably answer who owns them, what they can reach, or whether they still need access.
Q: What are the signs that shadow AI is already operating in an organisation?
A: Common signs include sudden productivity jumps in a team, unusual data uploads to external AI platforms, and unexplained API calls or suspicious queries to third-party services.
Practitioner guidance
- Map shadow AI to managed identities Build an inventory that ties every observed AI tool or agent to a specific employee, device, and access path.
- Restrict delegated access before agent use Apply least privilege to the initiating user and narrow repository, file, and system access before allowing an AI tool to run.
- Gate AI use on device trust Allow agentic tools only from managed, patched devices with known compliance status.
Bottom line: Shadow AI becomes a security issue when employees connect unapproved AI tools to real corporate credentials and data sources.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
12/06/2026 11:25 pm
Shadow AI is now an identity governance problem, not a tooling preference. Once an AI system can execute tasks, access data, and move information under user-granted permissions, the issue shifts from model selection to access control. That means identity teams must govern the actor, the device, and the permission path together, not as separate concerns. The practical implication is that AI adoption cannot be treated as a detached innovation stream.
A question worth separating out:
Q: How should teams govern AI use when humans are still the ones triggering it?
A: Teams should govern the human sponsorship, the delegated permissions, and the runtime behaviour as one chain. The employee may be accountable for initiating the workflow, but the organisation still has to constrain what the AI can inherit and where it can operate. That means identity, device trust, and least privilege must be enforced together.
👉 Read our full editorial: Shadow AI and the identity gap behind the silicon workforce
This post was modified 5 days ago by NHI Mgmt Group