Shadow AI Agents: Inventory and a Sanctioned Path

Shadow AI agents are already running in your company. Someone connected one to their email last month, and nobody in IT knows.

You cannot ban your way out of this. You can find them, list them, rank them by risk, and give people a faster official route.

This post gives you a discovery plan, an inventory template, a risk-tier scheme, and a 30-day start.

What shadow AI agents are

Shadow AI means AI tools that employees use without IT or security approval. A shadow agent goes one step further. It does not just answer questions. It acts: it reads mail, edits files, calls APIs, or runs workflows with credentials someone gave it.

Here is my working definition. A shadow agent is any AI system that can take actions with company data or accounts, and that your security team has not reviewed. That is my wording, not a standard.

Examples I’d look for:

• A browser agent a sales rep installed that clicks through your CRM.
• A custom assistant connected to Google Drive or SharePoint through OAuth.
• A workflow in an automation tool where one step calls an LLM and writes to a ticketing system.
• A coding agent with access to a private repository.
• A local tool server running on a laptop that gives an assistant access to internal files.

The usage numbers explain why this happens. Microsoft’s 2024 Work Trend Index found 78% of AI users are bringing their own tools to work. People are not hiding. They are trying to finish their work.

The cost is real. IBM’s 2025 Cost of a Data Breach research found 20% of studied organizations had breaches linked to shadow AI, adding as much as USD 670K to the average breach cost. It also found 63% of breached organizations lacked AI governance policies. Those are survey results from breached companies, so they describe who gets hurt, not how likely you are to be hit.

Why bans fail

The usual first move is a ban. It rarely holds.

Samsung banned generative AI tools in May 2023 after an engineer uploaded sensitive source code to ChatGPT. The concern was real. But a ban without an alternative leaves the need in place. People still have deadlines.

Bans fail for three reasons:

1. The tool is one browser tab away. Personal devices and personal accounts sit outside your controls.
2. The work does not go away. Staff who save an hour a day with an agent will not give that up on a memo.
3. A ban hides the problem. Usage moves out of sight, and people stop asking for help.

The better evidence comes from the other direction. The Netskope Cloud and Threat Report 2026, covering October 2024 through October 2025, reports that the share of AI users on personal AI apps fell from 78% to 47%, while use of organization-managed accounts climbed from 25% to 62%. Netskope reads that as companies standardizing AI access. The report does not prove the managed apps caused the drop. It also says incidents of users sending sensitive data to AI apps doubled, at an average of 223 per month per organization. So personal use is shrinking where managed options exist, and risk is still rising. That is one vendor’s customer data, not a universal truth. It matches my view: offer something better than the workaround.

Discovery sources

No single source finds everything. Use five, then compare.

1. Expense and card data. Search corporate card and expense reports for AI vendor names and for small recurring charges. Teams often put a $20 to $200 monthly subscription on a card. Ask finance for a 12-month export.

2. OAuth grants. Agents get access through “Sign in with” and “Allow access” screens. In Google Workspace, admins can see which apps access Workspace data and mark them Trusted, Limited, or Blocked. In Microsoft, review enterprise app consent. List every third-party app with mail, files, calendar, or contacts scopes. Sort by number of users and by scope breadth.

3. Browser extensions. If you manage browsers, pull the extension inventory. Look for AI assistants, “agent” extensions, and anything with broad “read and change all data on all sites” permission.

4. Network and DNS logs. Look for traffic to AI provider APIs and agent platforms. Netskope reports that 70% of organizations connect to api.openai.com, which shows how common direct API traffic is. Your proxy, DNS, or CASB logs show which teams call which services. API traffic from a user laptop (not a server) is a strong signal of someone’s own agent.

5. Code and secrets scanning. Search repositories and shared drives for AI provider API keys, tool-server configuration files, and automation exports. Rotate any key you find in the open.

Add two human sources. Run a short survey, and hold an amnesty week where anyone can list what they use with no blame. The amnesty often finds more than the logs, because it finds the why.

Inventory template

NIST’s AI RMF Playbook lists, under GOVERN 1.6, that mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities. Start simple. One row per agent.

Field	What to record
Agent name and purpose	One sentence on what it does
Business owner	A named person, not a team
Technical owner	Who can fix or turn it off
Status	Discovered, under review, sanctioned, retired
Model and vendor	Which model, which provider, which plan tier
Data it touches	Types: customer, employee, financial, source code, public
Systems it can reach	Mail, CRM, drive, repos, ticketing, databases
Credentials used	Personal login, shared key, service account, OAuth scopes
Actions it can take	Read only, draft, write, send, delete, spend money
Human review	None, sampled, every action
Where data goes	Vendor retention, training use, region
Logging	Are actions logged, and where?
Users	Count and teams
Discovery source	Which of the five found it
Risk tier	1, 2, or 3 (see below)
Decision and date	Approve, approve with changes, migrate, retire

Keep it in a shared sheet at first. Do not buy a platform before you have 20 real rows.

Risk-tier each agent

You cannot review everything at once. Tier by what the agent can do, not by how clever it is.

Tier	Test	Examples	Default action
1: Low	Reads public or non-sensitive data, no write access, no external sends	Summarizing public articles, drafting from pasted text	Allow under the acceptable use policy
2: Medium	Touches internal data or can draft and propose, a human approves every action	Meeting-note agent, support reply drafts	Fast review in days, add logging
3: High	Touches customer, financial, health, or code data, or can write, send, delete, or spend without review	Agent with mail send rights, CRM write access, payments	Full security review, least-privilege access, or shut down until reviewed

Anything with a personal login that reaches regulated data is Tier 3 until proven otherwise. For the permission side, see AI agent permissions and least privilege. OWASP’s Top 10 for Agentic Applications, published in December 2025, is a good checklist for what a Tier 3 review should cover.

For control on the Microsoft side, Entra lets you restrict user consent, for example to apps from verified publishers with selected low-risk permissions, and turn on an admin consent workflow. That closes the easiest door and gives people a request path at the same time.

A sanctioned path that wins

The goal is simple: the official route must be faster and easier than the workaround. If it is not, you will lose.

What I’d build:

• A one-page intake form. Five questions: what, who, which data, which systems, what actions.
• A published service level. Tier 1 same day. Tier 2 within five business days. Tier 3 within a stated window with a named reviewer. Pick numbers you can keep.
• A pre-approved list. Models, vendors, and tools already reviewed, with the enterprise plan settings turned on (no training on your data, retention limits, SSO).
• A paved road for builders. A shared gateway or template with logging, spend limits, and scoped credentials built in, so a team gets safe defaults without writing them.
• Office hours. A weekly hour where security and IT help teams make their agent compliant instead of rejecting it.
• A clear policy. Plain language on what is allowed, what needs review, and what is forbidden. I cover that in the AI acceptable use policy for agents.
• A no-blame migration offer. When you find a shadow agent, offer to move it onto the sanctioned path, and keep its owner as the owner.

Measure the path. Track median days from request to decision, and the number of shadow agents found per month. If the second number rises as the first falls, people are moving over.

For the bigger picture of rules, roles, and reviews, see AI governance in practice. For why this gap opens in the first place, read the AI governance gap. And a control list to review a Tier 3 agent against is in the enterprise AI security checklist.

First 30 days

Days 1 to 5: Set up. Name an owner for the inventory. Create the sheet. Announce an amnesty week with a clear message: tell us what you use, and we will help make it safe. Request the expense export, OAuth app list, browser extension inventory, and a week of proxy or DNS summaries.

Days 6 to 12: Discover. Run the five sources. Merge them into the sheet. Add what the amnesty and survey bring in. Do not fix anything yet.

Days 13 to 18: Tier. Tier every row. Find the Tier 3 items first. For each one, call the owner. Learn what the agent does for them.

Days 19 to 24: Contain. For Tier 3 agents on personal accounts: rotate exposed keys, remove excess OAuth scopes, move the work to an approved account, or pause it until review. Turn on admin consent for new high-risk scopes.

Days 25 to 30: Open the path. Publish the intake form, the service levels, and the pre-approved list. Hold the first office hours. Report to leadership: how many agents found, how many in each tier, what you contained, and what the new median approval time is.

Then repeat discovery every quarter. New agents appear constantly.

Bottom Line

Shadow agents exist. Find them with expense, OAuth, browser, network, and code data.

List each one, tier it by what it can do, and fix Tier 3 first.

Then make the official path faster than the workaround.

Next step: ask finance for the 12-month card export and ask IT for the OAuth app list this week.

FAQ

What is shadow AI? Shadow AI is any AI tool that staff use without IT or security approval. A shadow agent is the riskier version: it can take actions, such as sending mail or editing files, using company data or accounts. Most appear because employees want to get work done faster.

How do I find shadow AI agents? Use five sources: expense and card data, OAuth app grants, browser extension inventories, network and DNS logs, and code and secrets scanning. Add a short survey and an amnesty week. No single source finds everything, so compare them.

What goes in an agent inventory? For each agent: purpose, business and technical owner, model and vendor, data touched, systems reached, credentials used, actions allowed, human review, logging, user count, discovery source, risk tier, and decision date. Start in a shared spreadsheet.

How do I make the sanctioned path faster than shadow use? Publish a one-page intake form, set service levels by risk tier, keep a pre-approved list of tools, and offer templates with logging and scoped access built in. Measure median days to decision and report it.

Should I ban unapproved AI tools? I would not start there. A ban without an alternative pushes use out of sight. Block the highest-risk cases, such as personal accounts reaching regulated data, and open a fast approval route for the rest.

What should I do first? Request the 12-month expense export and the list of OAuth-connected third-party apps. Those two data sets find many agents quickly and cost almost nothing. Then announce the amnesty so people come to you.

Three Ways to Work With TMA

Need an agent built? We deploy production AI agents in your infrastructure. Working pilot. Real data. Measurable ROI. → Schedule Demo

Want to co-build a product? We’re not a dev agency. We’re co-builders. Shared cost. Shared upside. → Partner with Us

Want to join the Guild? Ship pilots, earn bounties, share profit. Community + equity + path to exit. → Become an AI Architect