Omarchy: How to Manage the Employee AI Agents You Can't Ban

You manage employee AI agents by treating them as software assets, not violations. Build an inventory of every agent, its access, and its owner, then apply the same identity, access, and lifecycle controls you'd apply to any application running in production. Bans don't work here. Ownership does.

The wave nobody can ban anymore

For years, IT departments handled unauthorized AI the way they handled unauthorized software: write a policy, block a domain, hope for compliance. That approach was already failing. Now it's obsolete.

In September 2026, AWS open-sourced Pizza Bot, a self-hosted inbox application that runs AI agents in the background across email, Slack, CRM tools, and web research. It has no telemetry. It runs on the employee's own machine, with whatever model provider they pick. Before AWS released it publicly, more than 2,000 Amazon employees were already using earlier versions for meeting prep, email drafting, and day prioritization.¹ That's not a pilot program. That's an internal habit that outgrew its walls.

A month earlier, xAI shipped Grok Bot, giving any employee an always-on cloud teammate that signs into their existing tools and finishes multi-step jobs end to end. xAI's own account of the launch says it started as an internal prototype, and "it took off across the company" as teams built bots for sales outbound, marketing campaigns, office operations, and bug fixes, long before it became a product.²

Both stories say the same thing: building a background AI agent has gone from an engineering exercise to a few-minutes task for anyone with a laptop and a login. The skill floor for "deploy your own AI teammate" has dropped to near zero. Blanket no-unauthorized-AI policies were built for a world where employees needed IT's help to run software. That world is gone.

What 'Omarchy' means: from banning shadow AI to owning it

Call it Omarchy: the practice of treating every employee-built agent as a legitimate internal software asset from the moment it exists, rather than contraband to discover and shut down later. It borrows its name and its spirit from the open-source Linux distribution built around the idea that AI agents are first-class citizens of the system, not guests to be quarantined.

Omarchy isn't permissiveness. It's the opposite. If an employee is going to run an agent with access to company email, CRM data, or internal APIs, that agent needs an identity, a scope, an owner, and an exit plan, the same as any piece of internal software would. The alternative, banning and hoping, has a track record, and it isn't good.

Why do bans on shadow AI fail?

Bans fail because the data on unauthorized AI use is consistent across every survey that's looked, regardless of company size or industry.

• Most employees already do it. A Cybernews survey of more than 1,000 US employees found 59% admit to using AI tools their employer hasn't approved.³
• Approval doesn't stop the behavior. Of employees who already have company-approved AI tools, 85% also use unapproved ones anyway.³
• It's systemic, not fringe. UpGuard found 81% of employees and 88% of security leaders themselves report using unapproved AI tools.⁴
• Small companies are hit hardest. Reco's 2025 Shadow AI Report found organizations with 11 to 50 employees average 269 unsanctioned AI tools per 1,000 staff, roughly 27% of employees actively using them, with some tools sitting undetected for a median of around 400 days.⁵

The historical precedent is Samsung. In 2023, after engineers leaked sensitive source code and internal meeting notes into ChatGPT, Samsung banned generative AI tools company-wide.⁶ The ban came after the incident, not before it, and it addressed a symptom rather than the underlying habit. Employee AI use didn't stop because a policy said so. It stopped being visible, which is worse.

The new attack surface: agents, not just apps

Shadow AI used to mean an employee pasting text into an unapproved chatbot. That's a data exposure risk, but a bounded one: a human types, a human reads the output, the interaction ends. Agents like Pizza Bot and Grok Bot don't work that way. They authenticate. They act. They keep running.

An agent that reads your inbox and updates your CRM needs an OAuth grant, an API key, or an MCP server connection to do it. Each of those is a non-human identity, and non-human identities already outnumber human ones by an average of 45 to 1 across enterprises, climbing to 144 to 1 in cloud-native environments.⁷ Only 15% of organizations feel highly confident they can prevent attacks that exploit those identities, and more than 16% don't track the creation of AI-related identities at all.⁷

Nudge Security argues this needs to be its own governance discipline, separate from general AI policy, precisely because these credentials bypass the discovery tools IT already relies on. OAuth grants and MCP connections don't show up in SSO or MDM logs the way an app installation would. They persist after the employee who created them leaves the company. And once you account for everything an agent's MCP connections can reach, its effective access is often far broader than whatever permission scope was written down when it was set up.⁸ That gap between stated and effective access is where employee-built agents start to resemble the agent swarms running with no registry and no owner that IT teams are already discovering after the fact.

What happens without governance

The open-source agent tool OpenClaw is the clearest recent illustration of what ungoverned, employee-run agents actually cost. In 2026 it suffered a wave of critical vulnerabilities, including a one-click remote code execution flaw tracked as CVE-2026-25253. A backend breach at the companion platform Moltbook leaked roughly 1.5 million API tokens and 35,000 user emails. Researchers found more than 42,000 OpenClaw instances publicly exposed on the internet, and 93% of those carried critical authentication bypass issues.

That's not a story about a bad actor exploiting a sophisticated flaw. It's a story about thousands of agents running with default configurations, exposed endpoints, and no one responsible for checking either. The same pattern that let those instances sit exposed is the pattern every self-hosted employee agent creates the moment it's deployed without a review: it runs, it has access, and nobody outside the person who built it knows it exists.

The Omarchy playbook: how to manage employee AI agents

Governing agents well means building the same discipline you'd apply to any piece of internal software, adapted for something that acts on its own.

1. Build an agent inventory. Every self-hosted or cloud agent should be logged with its identity, its access scope, its deployment source, and its MCP connections, not just the applications it runs inside.⁸
2. Apply least privilege from day one. Grant an agent only the OAuth scopes and API access it needs for its stated task, and treat any broader access as a finding to fix, not a convenience to leave alone.⁸
3. Run regular access reviews. Non-human identities accumulate quietly. A recurring review catches the agents whose access has drifted wider than their original purpose.⁷⁸
4. Monitor runtime behavior, not just setup. An agent's risk isn't fixed at deployment. What it actually does over weeks of unattended operation is the real signal, echoing the same "walk away" problem that shows up wherever agents run for days without a human checking in.
5. Fix the offboarding gap. When the employee who built an agent leaves, the agent frequently doesn't get deactivated with them. That's the single most common failure Nudge Security flags in agent governance reviews, and it's an easy one to close with a checklist tied to HR offboarding.⁸
6. Name an owner, not just a policy. CIO.com's framing is right: convert discovery into discipline by keeping a living AI registry with named stewards for each agent, and lean on established frameworks like NIST's AI Risk Management Framework or ISO/IEC 42001 to structure the audit trail.⁹

A platform like Remy exists for exactly this gap, giving teams a way to see, own, and lifecycle-manage the agents employees have already built instead of discovering them during an incident review.

Why this is a software-ownership story, not just a security one

It's tempting to file all of this under security, but that undersells it. An agent an employee built to triage support tickets or draft outbound emails is internal software the company now runs, whether or not anyone approved its creation. The same shift already happened with the apps employees build using AI coding tools, and with the business logic quietly encoded into saved ChatGPT memories and custom instructions. Agents are the next layer of the same pattern, just with more autonomy and more access.

That framing matters because it changes the goal. MIT NANDA's State of AI in Business 2025 report found that despite $30 to $40 billion in enterprise generative AI investment, 95% of pilots deliver no measurable P&L impact. The 5% that do succeed are almost always deeply embedded in a specific workflow, often built or closely shaped by the people using them, rather than purchased top-down as a generic tool.¹⁰ The employee who built Pizza Bot for their own inbox, or a Grok Bot for their own sales outbound, is closer to that successful 5% pattern than most enterprise AI procurement will ever get. The job isn't to stop them. It's to own what they built well enough that it survives their next reorg, their next manager, or their eventual departure.

What's coming next

This isn't a trend that peaks and fades. Gartner projects that task-specific AI agents will be embedded in 40% of enterprise applications by the end of 2026, up from under 5% in 2025.¹¹ By 2029, Gartner expects at least half of knowledge workers to have developed the skills to build, work with, or govern AI agents on demand.¹¹ Pizza Bot and Grok Bot aren't the peak of employee-built agents. They're the first widely visible instances of a practice that was already happening quietly inside companies like Amazon and xAI before anyone gave it a name.

The organizations that handle this well won't be the ones with the strictest ban. They'll be the ones that built the inventory, the ownership model, and the offboarding checklist before the wave arrived, not after the first exposed instance shows up in a breach report.