Topic starter
28/05/2026 11:36 am
TL;DR: Most enterprises underestimate how many AI agents are running, and platform registries miss shadow agents built on developer frameworks, local IDEs and homegrown services that authenticate through NHIs with real production access, according to Astrix Security. Discovery alone is not enough when agents can act before review cycles finish and policy decisions must move to runtime control.
Editorial analysis by NHI Mgmt Group, based on content published by Astrix Security: “What We’re Announcing at RSAC 2026: Discovery Across Every Layer, and Control Over What Agents Can Do”.
Key questions
Q: What breaks when AI agents are deployed without a registry?
A: Without a registry, teams lose the ability to tie runtime behavior to a verifiable identity, which means scopes, audit trails, and revocation become fragmented or invisible.
Q: Why do AI agents create more governance risk than ordinary integrations?
A: AI agents can connect quickly, run continuously, and accumulate broad permissions across multiple services.
Q: How can teams tell whether AI access is actually under control?
A: Look for evidence that access is limited by purpose, not just by account.
Practitioner guidance
- Map every agent trace source Inventory platform registries, NHI logs, endpoint telemetry and homegrown service traces as one discovery problem instead of separate tool outputs.
- Tie each agent to its executing NHI Record the NHI, credential path, resource scope and human owner for every agent so access can be governed as an identity relationship, not a feature list.
- Add pre-execution policy gates Use allow, flag and block rules that evaluate agent actions before they run, with special handling for unrecognized agent activity.
Bottom line: AI agents are becoming an IAM issue because they can operate through NHIs with production access before review cycles complete.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
28/05/2026 11:40 am
Shadow AI discovery is now an identity inventory problem, not a platform inventory problem: the article shows that sanctioned registries only expose the agents a platform already knows about. Agents running locally, through homegrown services or via developer frameworks remain outside that view even while they authenticate through NHIs. The implication is that governance teams must stop treating platform visibility as completeness.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and insufficient risk controls.
A question worth separating out:
Q: What should IAM teams do when an AI agent has no named owner or review record?
A: Treat the agent as an unmanaged identity and suspend reliance on implicit trust until its NHI, credential path, resource scope and accountable owner are recorded. Without those elements, IAM cannot establish who approved the access, what it can reach, or who is responsible for its continued operation.
👉 Read our full editorial: AI agent discovery and policy controls are now an IAM problem