Nobody Signed Off on This Agent: How Unregistered AI Identities Undermine Vault Governance

In the first post in this series, we made the case that every AI agent is also an NHI, one that authenticates with secrets instead of passwords, and multiplies faster than most security teams can track.

That post ended with a question: Do companies actually know if all the secrets behind all those agents are actually governed?

There's a more basic question underneath it. Governed by whom, for what, if nobody in the organization even knows the agent exists?

Nobody Signs Off on Most Agents

New employees go through onboarding. New service accounts, at least in a reasonably mature shop, go through some kind of request and approval flow. In many cases, new AI agents spin up without any type of onboarding.  

But for agents, it can be a very different process. A developer wires an agent into a CI/CD pipeline to auto-approve routine deployments. A team spins up an autonomous coding assistant connected to a shared repository. Someone in marketing signs up for an agentic tool with a personal account and connects it to internal systems because it saved them four hours on Tuesday. None of these show up on a provisioning ticket or get a security review. They just start running, pulling credentials from wherever they can reach, and doing their jobs quietly in the background.

This is not a hypothetical edge case, it's the default path that most agents end up getting inserted into a production environment.

Two Kinds of Shadow Agent, Same Blind Spot

It's tempting to picture "shadow AI" as something in the Matrix, an agent nobody controls, running wild. In practice, it's usually much more mundane, and it splits into two categories that create the same problem for different reasons.

The first is human-assisted. Someone on staff, with good intentions, connects an agent to a system because it's useful, and never tells security or IT it's there. The agent isn't malicious, just invisible. 

The second shows up differently: an agent that spins up its own sub-agents, requests its own access, or extends its reach into new systems without a human signing off on each step. Neither one was created to become an attack, and both leave the same evidence trail behind, secret retrievals, role assumptions, and access patterns with no registered owner attached to them.

Vaults and identity systems don't distinguish between these two cases either, because they were never built or asked to. A valid credential, retrieved through a valid authentication flow, looks the same whether it's serving a sanctioned agent or a shadow agent.

The Real Cost Isn't the Agent, It's the Attribution Gap

Let's take a scenario where a secret gets misused, reused across too many hosts, or retrieved from a strange location at 3am. The natural next question is: who did this? Was it a person, a specific agent, or a human quietly operating through an agent's assumed role to cover their tracks?

If the agent that retrieved the secret was never registered as an identity in the first place, that question doesn't have an answer. There's no owner to notify, no team to loop in, no way to tell an anomaly from routine automation. Security teams end up investigating a ghost, working backward from a log entry with nothing attached to it.

This is why comprehensive discovery has to come before governance, not alongside it. A rotation policy, a least-privilege rule, an access review, all of it assumes there's a known identity on the other end to apply the rule to. Governance logic pointed at an unregistered agent just returns nothing, silently, and everyone assumes that means nothing's wrong.

Discovering and Building the Inventory That Should Already Exist

Closing this gap starts with a complete ai agent inventory: every active agent in your environment, whether it's touched a vault or a secret, known and unknown, human-assisted and autonomous, with the access and activity context to go with it. Not a static list refreshed once a quarter, but something that stays current as new agents are created, because they will keep appearing faster than any manual process can track them.

From there, every subsequent piece of governance gets to work against something real. A specific agent, a specific NHI, a specific human, each with an actual identity attached to their activity instead of a credential name floating in a log file. Once you can see every agent touching a vault, harder questions become possible to ask. Is the vault itself secure from the identities reaching it, is it being accessed the way policy intends, and does what happens to a secret after retrieval actually match what was promised on paper. We'll discuss these in the next blog.

For now, the more immediate question is simpler, and less comfortable. If an audit asked for a complete list of every AI agent with access to your secrets today, could anyone actually produce one?