AI Agents - You Can’t Govern What You Can’t Discover

AI is expanding faster than anyone can imagine, as organizations race to use AI to gain a competitive advantage. It started with Generative AI. Now, agentic AI is changing the way people think and work. With the rise in usage of AI agents, the fear of data leakage and having more than necessary permissions has risen exponentially.

Agents are everywhere and organizations still do not have proven solutions to put guardrails around them to ensure secure usage and to prevent data exfiltration. Data is the most expensive asset organizations have and losing it can damage their branding and reputation.

AI agents are very different from traditional service accounts, as service accounts were meant for predictable tasks. AI agents can make their own judgements. AI agents can make decisions, make multiple API calls, and initiate more agents as needed.

Organizations are becoming more dependent on AI agents, whether it’s for documentation, code development, testing of code, or even chatbots. Employees can make their own agents to make their jobs easier. Not all agents need to be in an active state all the time. Some agents are made active for particular tasks and then go back to an idle state. Such agents, especially shadow AI agents, give cybersecurity teams a hard time with discovery.

AI agents: A new IAM challenge

As agents grow, it’s becoming a challenge for IAM teams to have appropriate governance of them. Traditional IAM tools/controls were meant either for human users or traditional non-human users like service accounts, bot accounts, etc. Non-human accounts were designed to do predictable tasks, like a service account being used to integrate two applications or a bot account being used to automate certain tasks.

AI agents are a different entity altogether. The entire definition of Identity has been changed. Earlier, an identity meant that users would join the organization, they would be assigned certain access based on their role and needs, they would change their role/department, or they would leave and access would be revoked.

But now with AI agents, they don’t take vacations, they don't leave the organization, and they work 24x7. Governance is very important for agents. We must know who these agents are, what they can do, what actions they can perform in which applications, who approved their access and actions, and who will be responsible for their behavior changes.

Is it really important to discover all these agents?

There’s a saying that you cannot manage/govern something that you cannot detect. Hence, the short answer is YES. We must discover these agents and register them in a centralized repository for proper governance and management.

Let’s understand the risk with a very common scenario:

Suppose, we have an application ABC and users are given access to this application through a proper process, i.e., with request, approvals, etc. To simplify, some users have WRITE permissions and some users have READ permissions in this application. The company is encouraging everyone to use AI to automate their tasks or to improve their productivity. Everyone is creating agents to automate their day-to-day tasks, analyze data better, identify patterns, etc. Agents are using the user’s context/permissions to access applications to work on behalf of the user. Agents are running locally on their devices.

Some people will argue that there isn't clear risk here. Agents are using the same permissions as users, so if a user has legitimate permission in the application, the user can also manipulate data. If the user's access is governed and managed appropriately, there’s no risk.

However, the biggest concern is that AI agents are not like humans. They make decisions by themselves with minimal human intervention. If users access the application, we have various other controls. For example:

• Multi-factor Authentication (MFA)
• Organization policies about the risk and consequences of manipulating data

Agents don’t understand such things.

We can definitely put a human layer in between. We can add an MFA layer as well for better security. But the connections from agents must be legitimate. We must ensure that operations are performed by our approved/authorized agents and not by some other random agents created by malicious actors.

Also be aware of the MFA fatigue problem. This security risk means we cannot use MFA for everything. We have to have some control to ensure that operations performed by an agent are legitimate and are by approved agents. There are no other agents that are using the user's context to perform illegitimate operations in the application.

Now think about this scenario:

• All agents are registered in a central repository that can perform operations on behalf of users.
• All high risk operations are protected by an MFA layer and a human layer.
• Proper logging and auditing is enabled for operations performed by agents.
• Additional monitoring layer is in place for detecting anomalies.
• Context-based/behavioral authentication is in place to ensure operations are performed from legitimate devices/systems, known locations, and there is no risk of impossible travel for agents' operation, etc.
• Any operation performed by an unregistered (new) agent in the application will be blocked automatically.

In this scenario, risk is minimal, as operations done by unauthorized or unapproved agents are blocked. This is the largest reason for discovering and governing agents through a centralized system. Once we maintain a centralized inventory, it will become easy to build and apply other security controls like authentication, authorization, alerting, monitoring, access controls, etc., around these agents.

AI agents are not just about achieving automation. They also mean introducing a new workforce with access to your digital systems and applications, a workforce that can work 24x7 with no leave, no PTO, and that can learn and make decisions by themselves. AI agent discovery is not the final step towards security. In fact, it is the first step. We cannot secure what we don’t identify.

Discover agents… Understand them… Make humans accountable for their operations… Govern them.