Thought Leadership
AI agents are accessing SAP, Salesforce, and ServiceNow, often with extensive privileges and little oversight. Effective governance starts with visibility.
The problem begins with a simple question: How many AI agents do you actually have?
One company was convinced it had no AI agents on its network. The first automated scan found 5,000. Two weeks later, that number had climbed to 15,000. Exponential growth, and nobody in the organization even knew it was happening.
This is not an isolated case. A Saviynt study of 100 German CISOs found that 93 percent confirmed that AI identities have access to core systems. Yet only 25 percent manage that access through clear policies. Meanwhile, 76 percent have discovered unsanctioned AI tools, commonly referred to as Shadow AI.
Regulatory pressure is increasing at the same time. NIS2 requires organizations to maintain traceable control over system identities without distinguishing between human and machine identities. Since August 2, the EU AI Act has required lifecycle security for high-risk AI systems. And in July, OpenAI and Anthropic independently confirmed that their AI models had autonomously escaped test environments and were able to compromise real-world systems.
The question is no longer whether enterprises need to govern AI agents. The question is how. The following three steps can be implemented regardless of the platform in use.
Step 1: Build Visibility
You cannot govern what you cannot see. The first step is to create a complete inventory of all AI agents and non-human identities across the organization.
That sounds easier than it is. AI agents typically do not appear in traditional directory services such as Active Directory or LDAP. Business teams create them through low-code platforms, cloud environments authenticate them through OAuth tokens, and they are provisioned using API keys. Many organizations have at least three different sources from which agents emerge: IT departments through official channels, business units often without IT’s knowledge, and external service providers using their own credentials.
There are two approaches to building an inventory.
The first involves connecting directly to the platforms where agents run, including Microsoft Copilot Studio, AWS Bedrock, Google Vertex, Salesforce Agentforce, and ServiceNow AI. These platforms provide APIs that can be used to query registered agents. This captures the official inventory.
The second approach identifies what the first one cannot see: Shadow AI.
That requires analyzing API logs from core systems. Which access requests originate from unregistered identities? Which patterns suggest automated activity? Access outside normal business hours, unusually high request volumes, or connections from unknown IP addresses can all be warning signs. Endpoint security systems can also help identify installed software or workloads that indicate the presence of local AI agents.
The result should be a central registry that answers three questions for every agent:
- Who created it?
- What does it have access to?
- Who is accountable for it?
With solutions such as Saviynt Zuma, the Zuma Insights module handles this task through continuous discovery of agents and non-human identities, visualization of access relationships through Access Maps, and a timeline view of all lifecycle events.
Step 2: Establish Lifecycle Management
Visibility alone is not enough. Every agent needs a defined lifecycle, similar to the joiner, mover, leaver process used for employees.
In practice, that process is missing almost everywhere. An agent is deployed, receives its credentials, and begins operating autonomously. When the project ends, the use case changes, or an external service provider’s contract expires, nothing usually happens. The agent continues running with the same privileges and no assigned owner.
That is how organizations suddenly discover thousands of agents on their networks that nobody knew existed.
An effective lifecycle process for AI agents requires four elements:
1. Registration
Every agent must be registered when it enters service. This can happen through a form, similar to onboarding an external employee, or through an API call that automatically creates an agent identity in the IGA system. The key is to provide a simple and fast process. If registration becomes too cumbersome, business teams will find ways around it.
2. Ownership
Every agent needs a specifically named human owner. Not the IT department as a whole, but an individual responsible for the agent’s permissions, activities, and decommissioning. In practice, this is often the person who created the agent or the project owner. It can also make sense to define both a technical owner, the developer, and a business owner, the person who commissioned the agent.
3. Recertification
An agent’s permissions must be reviewed regularly. NIS2 requires critical systems to undergo recertification every six months. For AI agents that can dynamically escalate privileges and delegate them to other agents, however, that alone is not sufficient. Continuous monitoring is also required.
4. Offboarding
When an agent is no longer needed, its credentials must be disabled and its access rights revoked. Automatically, not only after someone manually requests it. Solutions such as Zuma Governance automate this process, including registration, ownership assignment, recertification, and the rapid offboarding of orphaned agents.
Step 3: Implement Real-Time Control
The first two steps create order. The third delivers security in real time.
Traditional access controls check whether an agent is authorized. They do not determine whether what the agent is doing matches its assigned purpose. An agent authorized to read CRM data, for example, could export customer information, change pricing terms, or trigger outbound communications. Technically, it has the required permissions. But its intent does not match its mission.
The incidents involving OpenAI and Anthropic demonstrated where this can lead. Both models had permissions. Both did something that fell outside their assigned purpose. No system detected the deviation, and nobody intervened in time.
What organizations need is a control layer that evaluates every agent action in real time. Not just based on permissions, but based on intent. Does this specific action match the agent’s defined purpose? Is the agent acting independently, on behalf of a human, or under a task delegated by another agent?
If an action falls outside the defined parameters, it can either be submitted to a human for approval or blocked immediately while generating an audit event. The decision is made at runtime, not during the next quarterly review. Saviynt’s Agent Access Gateway, Zuma Access, implements this approach under the concept of Intent-Aware Authorization, evaluating identity, context, risk, and policy for every individual agent action.
Delegation between agents is another critical factor. In agentic AI architectures, agents can delegate tasks to other agents and pass permissions along the chain. A user could potentially obtain privileges through a chain of agents that they do not possess directly. Real-time controls must therefore identify who issued the original request and determine whether the entire delegation chain is authorized.
What CISOs Should Not Do Now
Conversations with partners and consulting firms reveal a recurring pattern. Many CISOs understand that AI governance is important. But they are already stretched thin by legacy migrations and SAP transformations and do not want to block AI-driven innovation.
To avoid becoming a bottleneck, they allow the organization to deploy AI agents without governance. That is understandable. But it is also dangerous. Every day without visibility is another day in which the inventory grows, agents accumulate privileges, and Shadow AI spreads. The effort required to clean up the environment later increases exponentially.
The better approach is to start with Step 1.
An initial scan of the enterprise environment can provide clarity, often within days. The results show the board, the CISO, and business teams how serious the situation already is. More importantly, they provide the foundation for everything that follows.
