Topic starter
20/08/2026 5:26 pm
TL;DR: By 2030, autonomous and semi-autonomous agents could scale into the trillions as BYOA, Shadow AI, and low-cost workflow creation turn every employee and system into a potential agent builder, according to ArmorCode. The governance problem is shifting from finding vulnerabilities to controlling ownership, context, and closure across fast-moving digital actors.
Editorial analysis by NHI Mgmt Group, based on content published by ArmorCode: “The Agentic Revolution: BYOA and the Rise of 5 Trillion Agents”.
Key questions
Q: What breaks when employees can create their own AI agents without governance?
A: The control that breaks is lifecycle ownership.
Q: Why do multi-hop AI agent workflows create more risk than single-agent automation?
A: Because each additional hop creates another place where scope can drift, tokens can be exchanged, and intent can be altered without a clear human checkpoint.
Q: How do security teams know if agent governance is actually working?
A: It is working only if the team can answer three questions quickly for any agent: what it can reach, what it did recently, and whether that behaviour matches intent.
Practitioner guidance
- Define agent ownership at creation Require every employee-built agent to have a named owner, business purpose, and explicit approval path before it can reach enterprise data or systems.
- Bind agent access to short-lived scopes Limit each agent to task-scoped permissions and revoke access when the task, context, or sponsoring business need ends.
- Track agent memory and context retention Inventory where agents store memory, what context persists between sessions, and which data classes can enter that memory layer.
Bottom line: BYOA turns employee-created agents into governed actors, which means IAM and NHI teams need lifecycle controls, not just visibility.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:15 pm
BYOA is an identity governance problem before it is an AI problem. The article shows that when employees can create agents in minutes, the organisation inherits a new class of non-human actor that behaves more like a delegated identity than a conventional app. That moves the issue into IAM and NHI governance, because the real control question becomes who owns the agent, what it can do, and how it is offboarded. Practitioners should treat agent creation as a lifecycle event, not a convenience feature.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should IAM teams treat BYOA differently from ordinary application onboarding?
A: Yes. Ordinary application onboarding assumes a relatively stable system with a predictable owner and lifecycle. BYOA introduces distributed, fast-moving, employee-created actors that may outlive the role or team that created them. IAM teams should govern them as living identities with creation, review, revocation, and closure controls.
👉 Read our full editorial: BYOA and trillions of agents will strain enterprise governance