Notifications
Clear all
Topic starter
20/08/2026 5:26 pm
TL;DR: By 2030, autonomous and semi-autonomous agents could scale into the trillions as BYOA, Shadow AI, and low-cost workflow creation turn every employee and system into a potential agent builder, according to ArmorCode. The governance problem is shifting from finding vulnerabilities to controlling ownership, context, and closure across fast-moving digital actors.
NHIMG editorial — based on content published by ArmorCode: The Agentic Revolution: BYOA and the Rise of 5 Trillion Agents Blog
By the numbers:
- Enterprise generative AI adoption crossed 70 percent in under two years, showing how quickly agentic adoption can outpace governance design.
- More than 50 billion connected devices globally create a machine ecosystem large enough to amplify agent-driven exposure across enterprise workflows.
- By 2030, the world may run on 5 trillion agents, according to ArmorCode's analysis of the agentic shift.
Questions worth separating out
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring.
Q: Why do APIs create identity risk for IAM and PAM programmes?
A: Because APIs rarely operate without credentials, and those credentials often outlive the service they support.
Q: What do organisations get wrong about shadow AI governance?
A: They often try to block unsanctioned tools at the network layer without changing employee behaviour or providing an approved alternative.
Practitioner guidance
- Define a governed agent inventory Create an inventory of all employee-built and system-built agents, including owner, purpose, data access, tool access, and retirement criteria.
- Bind agent access to short-lived credentials Issue scoped, short-lived credentials or delegated tokens for agent workflows so access expires with the task, session, or approval state.
- Apply privileged access controls to high-impact agents Classify agents that can approve, transfer, delete, or disclose data as privileged actors and subject them to step-up controls, approval paths, and break-glass review.
What's in the full article
ArmorCode's full blog post covers the strategic reasoning and directional forecasting this post intentionally leaves at the source:
- The detailed argument behind the five-trillion-agent projection and the assumptions used to build it
- The article's broader view of how M&A-driven complexity and legacy estates change the agentic threat model
- ArmorCode's explanation of why exposure management, not scanner volume, is the bottleneck in agentic environments
- The vendor's framing of aggregate, analyse, and automate as an operating model for the agentic economy
👉 Read ArmorCode's analysis of BYOA, shadow AI, and the rise of 5 trillion agents →
BYOA and agent sprawl: what IAM teams need to prepare for?
Explore further
20/08/2026 6:15 pm
BYOA is the point where agentic AI becomes an identity governance problem. Once employees can create their own agents, the enterprise is no longer governing a tool that a central team deployed. It is governing an expanding population of delegated actors with unclear ownership, variable scope, and inconsistent retirement. That means the familiar IAM question, who should have access, now extends to what should exist as an acting identity at all. Practitioners should treat BYOA as a governance boundary event, not an innovation milestone.
A question worth separating out:
Q: How do security teams reduce risk when agent populations grow faster than controls?
A: Prioritise the agents that can touch sensitive data, administrative systems, or financial workflows, then apply stronger approval, monitoring, and revocation controls to those first. Use identity-centric governance metrics such as ownership completeness, scope accuracy, and closure speed to show whether the programme is keeping up.
👉 Read our full editorial: BYOA and trillions of agents will strain enterprise governance
