The token lives past the terminal, the credential outstays the task. You cannot audit the shadow fleet whose name you forgot to ask.
In August 2026, Okta published an enterprise security survey with a pairing that deserves to be read without decoration. Ninety-one percent of surveyed organizations reported active AI adoption. Eighty-eight percent of that same group reported having already experienced a security incident involving an AI agent. The connective tissue named by the report was what identity teams have started calling shadow agents: autonomous software actors operating on corporate infrastructure without formal registration, procurement oversight, or directory presence.
Almost everyone has adopted. Almost everyone has already been surprised by what they deployed. The symmetry is not accidental; it is the structural consequence of a provisioning process whose speed outran its index.
What makes an agent shadow
Shadow IT used to mean an unapproved software subscription bought on an expense card. It was software sitting on an outside server, accessed through a browser, leaving an expense receipt and an IP log. Remediation was straightforward: cancel the card, block the domain, and bring the workflow into the central directory.
A shadow agent is a different operational animal altogether. Rather than an unapproved SaaS subscription, it runs as an autonomous process spun up inside an existing perimeter, often using a developer's legitimate API key or an engineer's personal access token. It inherits permissions from the human who launched it, performs tasks across internal databases, calls external APIs, and continues running long after the specific job that prompted its creation has concluded.
Because it operates under valid credentials, network monitoring sees ordinary traffic. Because it shares the identity of an authorized employee, access control systems record its requests as routine work. It leaves no distinct footprint in procurement records because nobody bought a new product. A developer simply configured a loop, pointed it at a model endpoint, and gave it permission to act.
The agent becomes a shadow not through malicious intent, but through administrative evaporation. The human moves on to another sprint, the script stays active on a container or a developer machine, and an actor with write access remains in the wild, unaccounted for in any central ledger.
The inventory problem
Governance begins with enumeration. You can only secure, throttle, inspect, or retire systems whose existence and boundaries are recorded.
In traditional enterprise security, identity was tethered to payroll and directory roles. When an employee joined, an entry was created in an identity provider. When they changed roles, permissions were adjusted. When they left, the account was disabled, severing access across the estate. Roles were coarse, but the ledger was complete: every active token mapped to a human being subject to company policy and supervisory oversight.
The introduction of autonomous agents breaks this accounting model at the root. When an agent creates sub-tasks or coordinates with peer agents across API boundaries, the credential chain detaches from the individual. Access reviews designed to ask whether Sarah in Marketing still needs access to the analytics warehouse cannot evaluate whether an autonomous summarizer spawned by Sarah three weeks ago should still be querying the production database at midnight.
The Unwatched Interval documented how the composition of software packages created capabilities nobody explicitly governed. Here, the same dynamic arrives at the level of identity and principal authority. Composition of autonomous actors now runs far ahead of directory registration. When authorization tokens are minted in milliseconds by running code, the administrative register becomes obsolete before the quarterly audit even convenes.
The asymmetry of creation and audit
The imbalance between provisioning and governance is an asymmetry of friction. Creating an autonomous agent requires a few lines of configuration, a model endpoint, and an API secret. The barriers to entry are practically zero, and the incentives for operational speed are overwhelming.
Auditing that same agent requires reverse-engineering its prompt history, tracing its tool invocations, mapping its inherited scopes, and determining whether its current actions align with its original mandate. Generating autonomy costs fractions of a cent and seconds of execution; auditing autonomy demands expensive forensic attention.
This reproduces the dynamic explored in The Container Is the Tell, where administrative plausibility served as camouflage for corrupted records. At the credential layer, administrative normality functions the same way. The request looks like an authorized user because it carries an authorized token. The log shows a valid session. Everything appears normal right up until the moment an unexpected transaction executes or confidential data leaves the perimeter.
Enterprise security teams find themselves forced into discovery-by-outage, the exact pattern analyzed in Detected by Outage. The organization learns it has an agent running in a specific system only when that agent exhausts an API quota or corrupts a database table.
Where the review fails
Periodic access reviews and least-privilege enforcement were designed for human employees with predictable working patterns and bounded cognitive bandwidth. A human employee requests access, justifies the business need, and operates within observable parameters.
An agent does not operate within human bounds. It can query hundreds of records per minute, chain credentials across services, and invoke external tools in combinations no human role designer contemplated. Applying human identity governance to an autonomous fleet is an institutional category error.
When security policies treat an agent token as merely another service account, they miss the defining trait of agency: dynamic goal pursuit. A standard service account runs deterministic code with fixed execution paths. An agent interprets instructions and formulates novel action sequences to fulfill its goal. Granting a dynamic actor a static credential means authorizing every unforeseen path that actor might devise to reach its target.
Without an enforced, machine-readable registry that binds every running agent to a named human sponsor before the first API call executes, least privilege is an illusion. The ninety-one percent adoption figure and the eighty-eight percent incident rate are not two separate statistics. They are the description of a single mechanism operating exactly as designed.
Companions
- The statistical baseline: Okta Security's 2026 AI Agent Identity Report.
- The package composition parallel: The Unwatched Interval.
- The camouflage of administrative routine: The Container Is the Tell.
- Incident discovery through failure: Detected by Outage.
- The operational remedy: the Interim Protocol, whose first rule is a register naming every point where a machine touched a deliverable, the tool, and the human who reviewed that touch. The register was written for documents; a fleet of principals needs the same table.
These notes come out of Sociable Systems, a practice that reads AI-shaped documents the way a hostile reviewer will, before a lender or a court finds the gap. The argument has an operational form: the Interim Protocol sets out four rules for AI use in environmental and social deliverables, covering disclosure at touch-point grain, evidence custody, the phrases no automated screening may settle, and a hostile read before anything ships. Free, and written to be cited or retired once institutional guidance arrives.