The most visible signs are missing inventory, no shutdown path, and agents still executing tasks after role changes or departures. If teams can revoke the person’s access but cannot name, locate, and remove the agent, the governance model is incomplete.
What broken zombie-agent governance looks like in practice
The clearest signal is operational drift, the organisation thinks it has revoked a person, but the agent still exists as a separate actor with its own access path. That means the agent is no longer tied to a clean owner, lifecycle, or control boundary. Shadow AI and AI Agent Discovery Guide is useful here because discovery is often the first proof that governance has fallen behind reality.
Other signs are more subtle: approvals exist on paper, but there is no inventory record that links an agent to an owner, no documented shutdown path, and no way to prove whether the agent is still active in production. When access review processes cover humans but not agents, governance has a blind spot rather than a control.
A mature model should answer three questions at any time: what the agent is, who owns it, and how it is removed. If any one of those cannot be answered quickly, the problem is not just missing documentation, it is missing authority over the agent’s lifecycle. Agentic AI Identity Guide maps that lifecycle from registration through retirement, which is exactly the control gap zombie agent expose.
Why the failure shows up after role changes or departures
Zombie agents often become visible only after a human change event, such as a transfer, termination, or team reshuffle. That is because the agent’s continued operation shows the organisation has treated the person as the control object and the agent as a hidden dependency. If the person’s access is removed but the agent keeps working, the enterprise has revoked the user, not the delegated capability.
This is where the governance model usually fails in one of two ways. Either the agent was never registered as a managed asset, or it was registered but not tied to enforceable offboarding and review steps. Both conditions create stale authority, where the system still executes actions after the original business justification has disappeared. Zero Trust for AI Agents is a good conceptual anchor because the control question is whether every action is re-verified, not whether the original user once had permission.
The practical warning sign is mismatch between human lifecycle events and agent behaviour. If the organisation can close a ticket for the employee but cannot show the corresponding agent deprovisioning, the governance process is incomplete. The failure is not theoretical, it is observable in stale runtime authority.
How to tell governance failure from ordinary automation
Not every automated task is a zombie agent. The differentiator is whether the system can be named, located, owned, and shut down without relying on tribal knowledge. If the answer is no, you do not have simple automation, you have unmanaged agency. AI Agent Observability, Audit and Incident Response Guide is relevant because the minimum proof of control is an attributable action trail and a tested kill switch.
Another practical test is whether the agent’s actions can be correlated to a current business purpose. Healthy governance shows an owner, a scope, a review cadence, and a termination path. Zombie governance shows none of those, or shows them only in a spreadsheet that is not enforced by the runtime. When the only evidence of control is administrative intent, the control is weak.
What to prioritise: Treat missing inventory and missing shutdown as the highest-severity indicators, because both mean you cannot prove containment. Then check whether agent action logs still exist after the human owner changes, since continued execution after a role change is the clearest sign the control boundary is broken.
What good looks like: Every agent has an owner, a unique identity, a current purpose, and an enforced offboarding path. If the organisation can answer those four points in minutes rather than days, governance is probably operating as a real control rather than a recordkeeping exercise.
Practitioner takeaway: Zombie-agent governance fails when the enterprise can revoke the person but not the delegated capability; the decisive evidence is whether the agent can be found, attributed, and shut down as a first-class object.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Zombie agents persist when delegated authority outlives the human owner. |
| ASI10 — Rogue Agents | Unowned or unshuttable agents are effectively rogue from a governance perspective. | |
| Recommendation — Enforce per-action authorization and revoke agent privileges when ownership changes. Require inventory, ownership and a tested shutdown path for every agent. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Agent offboarding and lifecycle control mirror account lifecycle governance. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Auditability is needed to prove whether an agent still acts after a role change. | |
| IA-5 — Authenticator Management | Zombie agents often persist through unmanaged credentials or tokens. | |
| Recommendation — Disable or remove agent access when the business owner or purpose changes. Review logs to confirm agent actions stop after revocation or offboarding. Rotate or revoke the credentials that keep an agent operational. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 8, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org