Turning Discovery into Action: What to Do When You Find Your First Shadow Agent

Picture this scenario. You just finished a full audit of your IT systems.

First, you pulled the OAuth token report from Salesforce. Next, you checked the browser extensions in your device management tools. Finally, you reviewed the API key list that your engineering team maintains. You think you have a good handle on your network.

But then, you see it.

You found an AI agent that you never approved. It is running on login credentials that your team did not issue. Even worse, it is accessing secure systems it has no right to touch.

So, what do you do now?

This is the exact moment when most IT teams freeze up. Shutting down the rogue agent feels like a huge risk. What if a key department relies on it for their daily work? You could break an important business process. On the other hand, leaving it alone is not an option. Ignoring it is a major security risk and feels completely irresponsible.

You are stuck in the middle. Many teams lack a formal plan for handling this exact problem. Because of this, simply finding the issue never leads to actually fixing it. The whole process just stalls out. What you need is a clear path forward. Here is a step-by-step decision framework. It will help you move away from just seeing the problem, and guide you toward taking real action.

Step 1: Assess Before You Act

The first instinct of most IT teams would be to shut it down immediately, which is understandable, but it might not always be the right call. Before you make any changes to the agent or its access, you need to gather the information that will help you in making a decision.

Questions that you need to answer in the assessment phase:

What does it do? 

Identify the agent’s function. Is it automating a routine internal process, or does it have write access to production data?

Who deployed it? 

Trace the agent back to a human owner. This person becomes your primary contact and, ultimately, the accountable party for the agent’s actions.

What does it access? 

Map every system, dataset, and credential the agent touches. Pay particular attention to whether it has access to financial records, customer data, or production infrastructure.

What permissions does it hold? 

Determine the scope of its entitlements. Is access narrowly scoped to what its task requires, or does it hold broad permissions that exceed its function?

Is it still actively running? 

Some shadow agents are orphaned. They were deployed for a project that ended months ago, and are still authenticated, with no active owner. These zombie agents carry their own risk profile.

This assessment takes time, but it’s the foundation for every decision that follows. Skipping it means making remediation choices without adequate context—and that’s how you create new problems in the process of solving old ones.

Step 2: Apply the Decision Tree

Once you have a clear picture of what the agent is doing and how it’s operating, you have three primary remediation paths.

Option A: Decommission It

When to choose this path: The agent does not have an active owner. Its function duplicates a capability that your organization already has, through sanctioned tools. It accesses sensitive data without adequate justification. Or its security posture is fundamentally incompatible with your governance requirements.

How to execute:

1. Notify the original deployer (if identifiable) and their manager before making changes.
2. Revoke all API keys, OAuth tokens, and credentials associated with the agent.
3. Remove any browser extensions or software installations from managed endpoints.
4. Document the decommission in your incident log, including the agent’s function, access scope, and the reason for removal.
5. Check for downstream dependencies, for example: other agents or workflows that may have been relying on this one as part of a chain.

The last point matters more than most teams anticipate. Agentic workflows increasingly involve agent-to-agent interactions. Removing one agent without mapping its dependencies can break processes in ways that take time to surface.

Option B: Register and Govern It

When to choose this path: The agent is actively used, provides genuine business value, and can be brought into compliance with your governance framework without significant rework. This is often the right call for workflow automation agents that have been running reliably and have a clear, identifiable business owner.

How to execute:

1. Assign formal human ownership. One named employee who is accountable for the agent’s actions and responsible for requesting any changes to its access.
2. Document its purpose, scope, and approved systems in your non-human identity (NHI) inventory.
3. Replace personal API keys and OAuth tokens with organization-managed service accounts and credentials.
4. Apply precision-scoped entitlements: the agent should have access only to what its specific task requires and nothing more.
5. Set time-boxed permissions where applicable to prevent privilege creep over time.
6. Establish a review cadence. Every registered agent should be reassessed at a defined interval (quarterly is a reasonable starting point) to confirm its ownership, scope, and business justification remain current.

Registration doesn’t mean approval in perpetuity. It means the agent is now visible, accountable, and subject to the same governance lifecycle as any other managed identity in your environment.

Option C: Adjust Permissions and Monitor

When to choose this path: The agent is valuable and can remain operational, but its current access scope exceeds what its function requires. This is the most common scenario for unvetted AI connectors and API integrations.

How to execute:

1. Identify the minimum access the agent needs to perform its function effectively.
2. Revoke any permissions that exceed that minimum—broad read access, write access to systems outside the agent’s scope, admin-level entitlements that are not necessary.
3. Implement continuous monitoring on the agent’s activity. Any behavior that deviates from its defined function should generate an alert for human review.
4. Establish a human-in-the-loop checkpoint for any high-risk or destructive actions the agent might attempt.
5. Conduct a formal review within 30 days to confirm the adjusted permission set is working as intended and hasn’t created downstream gaps.

This path is most appropriate for agents where the use case is clear and valuable, but the original deployment didn’t apply the access controls your governance framework requires.

Step 3: Close the Loop on Zombie Agents

Zombie agents are orphaned non-human identities with standing access and no off switch. Because they’re rarely monitored, an attacker who finds one can inherit whatever entitlements it holds. And unlike human offboarding, the agents simply persist.

For each agent you have to:

• Make an attempt to identify the original deployer through deployment timestamps and access logs.
• Initiate decommissioning by default if no owner can be identified within 48 hours,
• Find a way to revoke all credentials and document the removal.
• Use the discovery as a trigger to implement automated deprovisioning workflows, so that the next time an employee is offboarded, any agents associated with their credentials are revoked automatically.

Eighty-three percent of organizations now manage more non-human identities than human users. Manual offboarding doesn’t scale at that ratio. Automated deprovisioning isn’t a nice-to-have, it’s the only way to prevent agents from becoming a permanent feature of your environment.

Step 4: Build the Process That Prevents the Next One

A single shadow agent discovery is a data point. Multiple discoveries are a pattern. And the pattern tells you something important: your organization’s current path to deploying AI agents creates more friction than it removes, so employees are routing around it.

The remediation process above is the right response to what you’ve already found. But prevention requires a different intervention: giving employees a governed path to deploy agents in the first place.

That means establishing a lightweight registration process that’s fast enough to be used, secure enough to satisfy your compliance requirements, and clear enough that employees understand what it asks of them. The goal is to make the sanctioned path easier than the shadow path, and not harder.

When your teams know how to deploy an agent with a verified identity, scoped access, and a human owner, the incentive to work around IT disappears. Discovery becomes routine rather than reactive. And your NHI inventory stays current because it’s being maintained as agents are deployed, not after they’ve already been running for six months in the dark.

The Bigger Picture

Finding your first shadow agent isn’t a crisis. It’s a signal and an opportunity.

It tells you that your teams are motivated to move faster and automate more. It tells you that the demand for agentic AI in your organization is real and growing. And it gives you a concrete starting point for building the governance infrastructure that turns that demand into a competitive advantage rather than a liability.

The organizations that respond to discovery with a structured remediation process and use that process to inform a broader governance framework will be the ones that scale AI adoption safely. The ones that respond with blanket restriction will find themselves managing the same risk, with less visibility, six months from now.

Download the full eBook, The New State of Agentic Shadow AI, for the complete Discover / Register / Manage / Govern framework. Or start a free trial with JumpCloud today to bring every agent in your environment into the light.

The New State of Agentic Shadow AI

Meet the newest form of shadow IT: learn why it’s risky and how to stop it.

Read Now