Unmanaged agents and Skills create blind spots in access, audit, and accountability. Without discovery, security teams cannot tell which identities are acting, what data they can reach, or whether approvals exist. That makes it harder to block unsafe automation, investigate incidents, and bring high risk activity under formal governance before it scales.
Why This Matters for Security Teams
shadow ai agents and unmanaged Skills break the basic assumptions behind identity governance. If discovery happens late, teams inherit automation that already has tool access, data reach, and implicit approvals without a clear owner. That turns ordinary IAM gaps into audit failures, incident response delays, and policy exceptions that are difficult to unwind safely. The issue is not just visibility; it is whether autonomous action has entered the environment before governance did.
This risk is growing as agentic workflows chain tools, call APIs, and reuse secrets in ways traditional inventories miss. NHI Management Group has highlighted how unmanaged identities and poor lifecycle discipline create downstream exposure across the Top 10 NHI Issues, and the same pattern appears in agentic environments when discovery is absent. Industry guidance also points to runtime governance as the safer model, not after-the-fact review, as reflected in the NIST AI Risk Management Framework. In practice, many security teams encounter the first unmanaged agent only after it has already touched sensitive systems or leaked access through an untracked integration.
How It Works in Practice
Effective discovery starts with identifying the workload identity behind each agent or Skill, then mapping what it can actually invoke at runtime. That includes connected SaaS apps, MCP endpoints, API tokens, service principals, and delegated human approvals. For agentic systems, static role review is not enough because the agent may change behavior by prompt, context, or task sequence. Best practice is evolving toward continuous discovery plus policy enforcement at the moment of action, not just during onboarding.
Teams usually combine multiple signals:
- Cloud and IAM logs to find service accounts, OAuth grants, and unused credentials.
- Application telemetry to detect new tools, connectors, and autonomous task runners.
- Secrets scanning to locate embedded tokens and shared credentials.
- Policy engines to evaluate whether an agent may proceed with the requested action.
That approach aligns with the agentic control themes in the OWASP Agentic AI Top 10 and the operational threat modeling structure in the CSA MAESTRO agentic AI threat modeling framework. It also fits what NHIMG has documented in the Moltbook AI agent keys breach, where exposed agent keys turned hidden automation into direct access. When discovery is delayed, organisations cannot tell whether an agent is benign, over-privileged, or already compromised, and that uncertainty blocks safe containment. These controls tend to break down in environments with shadow IT, self-service app builders, and loosely governed SaaS integrations because the identity surface expands faster than inventory can keep up.
Common Variations and Edge Cases
Tighter discovery often increases operational overhead, requiring organisations to balance visibility against deployment speed. Some teams can inventory agents centrally, while others have Skills created inside collaboration platforms, IDE plugins, or business units that bypass platform controls entirely. Current guidance suggests there is no universal standard for classifying every agent-like workflow yet, so organisations should prioritise discovery based on blast radius rather than perfect taxonomy.
One important exception is low-risk automation with no external data access and no tool execution. Those cases may not justify full agent governance immediately, but they still need enough telemetry to prove they are harmless. Another edge case involves federated environments where one team owns the model, another owns the tool chain, and a third owns the data. Without an agreed owner, shadow agents persist even after technical discovery. NHIMG research on the Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs shows why lifecycle ownership matters, while the OWASP NHI Top 10 reinforces that unmanaged identity is the real control failure, not the label attached to the workflow.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A01 | Discovery gaps leave shadow agents and unsafe tool use outside control. |
| CSA MAESTRO | TRM-1 | MAESTRO centers threat modeling and visibility for agentic systems. |
| NIST AI RMF | GOVERN | AI RMF governance depends on knowing which AI systems exist and who owns them. |
| OWASP Non-Human Identity Top 10 | NHI-01 | Unmanaged Skills often hide non-human identities and shared credentials. |
| NIST CSF 2.0 | ID.AM-1 | Asset inventory is the foundation for finding shadow AI agents. |
Extend asset inventory processes to include agent identities, tools, and approvals.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
