Topic starter
12/06/2026 9:42 pm
TL;DR: AI agents created by employees can keep running after offboarding, leaving organisations with no centralized shutdown path, no inventory, and no agent offboarding protocol, according to JumpCloud. That is not a tooling gap alone; it is a workforce definition failure that makes human lifecycle controls incomplete for autonomous systems.
Editorial analysis by NHI Mgmt Group, based on content published by JumpCloud: “Offboarding Humans, Leaving Zombies: The New Workforce Risk”.
By the numbers:
- 55% of organisations lack a centralized way to shut down an AI agent if it goes rogue or if its human owner leaves the company.
Key questions
Q: What breaks when AI agents are not included in offboarding?
A: When AI agents are excluded from offboarding, they can keep accessing data and systems after the human owner leaves.
Q: Why do AI agents create a governance problem for IAM teams?
A: AI agents create a governance problem because they authenticate and act as autonomous software entities with tool access.
Q: How should organisations offboard an AI agent when a workflow changes?
A: Organisations should offboard an AI agent by revoking credentials, removing tool bindings, and checking for downstream service accounts or deployment hooks created for the workflow.
Practitioner guidance
- Inventory employee-created agents at creation time Record every AI agent as a governed asset when it is deployed, including purpose, owner, data access, and the human accountable for it.
- Bind agent privilege to the responsible human role Prevent an agent from holding more access than the employee role that sponsors it, and review any exceptions through the normal approval chain.
- Extend leaver processing to digital proxies Add explicit steps to identify, transition, or deprovision agents during offboarding so human exit does not leave active runtime systems behind.
Bottom line: The article shows that offboarding can be operationally complete for a person while still leaving autonomous systems active behind them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
12/06/2026 11:57 pm
Zombie agents expose a workforce definition failure, not a tooling gap. The article’s core point is that organisations have defined leavers for humans but not for the autonomous systems they create and operate. That means existing HR and IAM processes can appear successful while machine activity continues outside the control boundary. The practitioner takeaway is that lifecycle governance must be written for the workforce as it now exists, not as it was assumed to be.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What signals show that zombie agent governance is failing?
A: The most visible signs are missing inventory, no shutdown path, and agents still executing tasks after role changes or departures. If teams can revoke the person’s access but cannot name, locate, and remove the agent, the governance model is incomplete.
👉 Read our full editorial: Zombie agent governance is the next offboarding problem
This post was modified 5 days ago by NHI Mgmt Group