GOV-16: Shadow agent detection
In short: Find agents that were created without registration, including agents connected through personal accounts or tokens outside single sign-on. Most agents start as experiments. The ones nobody registered hold real access with no owner, no purpose, no review and no audit trail.
1GOV-16
What does GOV-16 require?
Find agents that were created without registration, including agents connected through personal accounts or tokens outside single sign-on.
Why does it matter?
Most agents start as experiments. The ones nobody registered hold real access with no owner, no purpose, no review and no audit trail.
How do you test it?
- Ask how unregistered agents are found, and how often.
- Create a test agent with a personal token and see if it is detected.
- Check detected agents get an owner or are removed.
Which platforms document GOV-16?
Documented by NewCore, Silverfort and Astrix Security.
- 9.10NewCore documentedSource: NewCore: Discover, read
- 8.35Silverfort documentedSource: Silverfort: AI Agent Security, read
- 7.30Astrix Security documentedSource: Astrix at RSAC 2026, read
- 6.55Token Security partly documentedSource: Token Security home, read
- 6.55SailPoint Entro partly documentedSource: SailPoint agentic AI security, read
- 6.35Clutch Security partly documentedSource: Clutch Security platform, read
- 7.30Cyera Identity not found in public materialChecked: Oasis Agentic Access Management; Cyera completes Oasis Security acquisition, read
- 6.85Descope not found in public materialChecked: Descope Agentic Identity Hub; Descope Agentic Identity Hub 3.0, read
- 6.55Aembit not found in public materialChecked: Aembit home; Aembit IAM for Agentic AI is generally available; Aembit pricing, read
- 5.50Idira not found in public materialChecked: Palo Alto Networks introduces Idira; CyberArk Secure AI architecture docs; Palo Alto Networks completes CyberArk acquisition, read
Which framework references apply?
- OWASP Agentic Top 10ASI10 Rogue Agents: Agents acting outside their intended behaviour. Source: OWASP Top 10 for Agentic Applications 2026
Which controls are related?
- GOV-01Agent inventory
- GOV-17MCP server registry
Glossary: agent inventory, shadow agent.
Reviewed by The Register desk