---
title: "Shadow AI Governance: How to Secure the Agents Employees Build"
url: "https://goremy.ai/blog/articles/shadow-ai-governance-a-step-by-step-framework"
author: Josh
editor: Josh
editor_title: Chief of Staff, GTM & Product
published: "2026-09-18T05:00:14.825Z"
updated: "2026-10-28T16:04:39.796Z"
topic: Shadow AI Governance
description: "No-code tools let employees build real agents fast. Here's the identity-based, lifecycle-aware framework for governing shadow AI before it breaches you."
---

# Shadow AI Governance: How to Secure the Agents Employees Build

> No-code tools let employees build real agents fast. Here's the identity-based, lifecycle-aware framework for governing shadow AI before it breaches you.

Edited by Josh, Chief of Staff, GTM & Product · Published 2026-09-18 · Updated 2026-10-28

## What is shadow AI governance, and how do you secure the agents employees build?

Shadow AI governance means finding and controlling the AI tools and agents employees build or bring into work without IT approval, then applying identity-based access controls, monitoring, and lifecycle rules so those systems don't become unmanaged attack surface. It's the successor to shadow IT governance, but the software involved doesn't sit still. It rewrites its own steps, calls new tools, and spawns sub-agents on its own.

## TL;DR

- Shadow AI is now the default, since **78% of AI users** bring their own unsanctioned tools to work without IT approval.
- When shadow AI is involved in a breach, it adds **$670,000 more** on average than a breach with low or no shadow AI.
- Non-human identities and agent credentials already outnumber human users **45 to 1**, so inventorying them is the first step.
- Traditional shadow IT controls fail because agents **acquire permissions dynamically**, spawn sub-agents, and evolve after approval.
- Securing employee-built agents takes a **five-step framework** covering discovery, least-privilege identity, a safe build path, monitoring with kill switches, and culture.
- The average Fortune 500 enterprise is projected to run **over 150,000 agents** by 2028, which makes manual oversight unworkable.

## What Does Shadow AI Actually Mean Now?

Shadow IT used to mean an employee signing up for a SaaS tool without a purchase order. Shadow AI starts the same way, an unsanctioned ChatGPT account, a free-tier Claude subscription, but it doesn't stop there anymore. [1] Employees are now building actual autonomous agents: workflows that read from a database, call an API, take an action, and decide what to do next without a human in the loop. [2] [3]

That distinction matters for governance. A rogue SaaS subscription is a static thing you can find with an expense report or a CASB scan. An agent an employee built last week can modify its own behavior, request new permissions, and chain itself to other agents by next week. IBM frames shadow AI as unsanctioned AI use without formal oversight, [1] but the tooling available today pushes that unsanctioned use straight into production systems. We've covered how this shows up in specific forms already, from [ChatGPT memory quietly becoming institutional logic](https://goremy.ai/blog/articles/managing-employee-chatgpt-prompts-as-internal-tools) to [employees wiring agents directly into company databases](https://goremy.ai/blog/articles/5-ways-to-secure-database-access-for-ai-agents).

## How Are Non-Engineers Building Real Software?

The barrier to building an agent used to be code. It isn't anymore.

OpenAI's Agents API, in public beta, lets a developer create a production-ready agent in a single API call by specifying a task, model, tools, and environment. [4] Its companion, Agent Builder, strips out the API call entirely: a visual, no-code canvas that lets internal teams assemble sophisticated agents without any coding expertise. [5]

Hyperbrowser's open-source HyperAgent does the same thing for browser automation. Instead of writing Playwright scripts, a person types a command like `page.ai()` or `page.extract()` and the agent figures out the rest. It's built to work as an MCP client, meaning it can be chained into full workflows across systems like Google Sheets, without an engineer touching a line of automation code. [6]

That's the actual mechanism behind the shift: tools that used to require a developer now require a business analyst with an idea and twenty minutes.

## How Widespread Is Shadow AI, Really?

The data backs up what this feels like from the inside. Seventy-eight percent of AI users at work already bring their own AI tools, outside IT approval, a practice more common at small and midsize companies where 80% of AI users do it. [7] Shadow AI usage isn't a fringe habit. It's the default behavior.

**Shadow AI by the Numbers**

- 78%: AI users at work who bring their own unsanctioned AI tools
- $670,000: Extra average breach cost when shadow AI is involved
- 63%: Breached organizations with no AI governance policy

Governance hasn't kept pace. Sixty-three percent of breached organizations lacked an AI governance policy, and only 37% had any kind of approval process or oversight mechanism. [8] When shadow AI is involved in a breach, it costs $670,000 more on average than a breach with low or no shadow AI present, $4.63 million versus $3.96 million. [9] Ninety-seven percent of organizations that suffered an AI-related security incident lacked proper AI access controls. [8] [9] Fewer than 11% of AI applications in the workplace are even visible to IT teams, according to one industry estimate. [3]

**Governance Gaps Behind AI-Related Incidents**

- 97%: Organizations with an AI security incident that lacked proper AI access controls
- 15%: Organizations highly confident they can prevent a non-human-identity attack
- 40%: Enterprises projected to demote or decommission autonomous agents by 2027

## Why Do Traditional Shadow IT Controls Fail Against Agents?

CASB tools and app allowlists were built to catch static software: a known app, a known login, a known set of permissions. Agents break that model in three specific ways.

- **They acquire permissions dynamically.** An agent built to summarize a spreadsheet can, mid-run, request access to a new API or file it wasn't originally scoped for.
- **They spawn sub-agents.** One employee-approved agent can create others on the fly, each with its own credentials and its own blast radius, without ever going through a review.
- **They evolve.** The agent your security team reviewed in January isn't the same agent running in March. Its prompts, tools, and connected systems have all changed.

A one-time approval, the core mechanism of legacy shadow IT control, doesn't work against software that changes after approval. This is the same structural gap we've written about with [skills files that carry runtime privileges](https://goremy.ai/blog/articles/how-to-secure-ai-agents-and-skills-files) and with [agent swarms that have no registry or owner](https://goremy.ai/blog/articles/how-to-manage-ai-agents-in-the-enterprise-a-practical-guide).

## How Do You Secure Shadow AI? A Five-Step Framework

Securing employee-built AI agents takes five steps, run in order and then repeated on a schedule, not once and filed away.

### Step 1: Discover and Inventory Every Agent and Non-Human Identity

You cannot govern what you cannot see. Non-human identities, service accounts, API keys, OAuth tokens, and now AI agent credentials, already outnumber human users by an average of 45 to 1, and that ratio climbs to 144 to 1 in cloud-native environments. [10] Only 15% of organizations feel highly confident they can prevent an attack based on a non-human identity. [10]

**Non-Human Identities Outnumber Humans**

| Environment | Ratio to one human user |
| --- | --- |
| Average enterprise | 45 to 1 |
| Cloud-native environments | 144 to 1 |

Build a real inventory:

1. **Stand up an NHI registry.** Every service account, API key, and agent credential gets logged with an owner, a purpose, and an expiration date.
2. **Run CASB and API-traffic discovery.** Look for calls to OpenAI, Anthropic, Hyperbrowser, and similar endpoints coming from unexpected teams or accounts.
3. **Interview business units directly.** The Quickbase citizen-developer playbook found that talking to teams surfaces far more shadow tools than scanning alone. [11]

### Step 2: Apply Identity-First, Least-Privilege Access to Agents

Once you know an agent exists, treat it like a hire, not a tool. NIST's AI Risk Management Framework and OWASP's Top 10 for Agentic Applications both push the same principle: give each agent its own identity, scope its permissions to exactly what its task requires, and default to zero standing privilege. [12] [13]

- **Issue a unique agent ID**, never a shared service account, for every deployed agent.
- **Grant time-boxed, task-scoped access** instead of standing credentials that persist after the job is done.
- **Require re-authorization** whenever an agent requests a new tool, database, or scope.

### Step 3: Create a Fast, Safe Path for Citizen-Built Agents

Banning employees from building agents doesn't stop them. It just moves the building further from view. Citizen-developer governance for low-code platforms solved this problem years before agentic AI existed, and the fix carries over directly: fusion teams pairing business users with IT, sanctioned templates, and pre-approved guardrails so people build inside a managed lane instead of entirely outside it. [11]

- **Publish an approved agent-builder list** covering tools like OpenAI's Agent Builder and vetted no-code platforms.
- **Provide templates** for the most common use cases so employees start from a governed baseline, not a blank canvas.
- **Set a fast-track review**, days not months, for agents that touch production data or external systems.

This is the same lesson we've applied to [employee-built codebases](https://goremy.ai/blog/articles/how-to-manage-employee-built-ai-apps-a-governance-guide) more broadly and to [auditing AI-generated code before it ships](https://goremy.ai/blog/articles/ai-generated-code-security-risks-5-governance-rules).

### Step 4: Monitor, Audit, and Build in Kill Switches

Approval is a snapshot. Agents keep running after that snapshot is taken. Gartner projects the average Fortune 500 enterprise will run more than 150,000 agents by 2028, up from fewer than 15 in 2025. [14] At that scale, manual oversight breaks down without [automated monitoring](https://goremy.ai/blog/articles/how-to-monitor-ai-agents-in-the-workplace-a-step-by-step-guide).

**Projected Agent Sprawl at the Average Fortune 500 Enterprise**

| Year | Agents in use |
| --- | --- |
| 2025 | 15 agents |
| 2028 (projected) | 150,000 agents |

_2028 figure is Gartner's forward projection; scale difference is intentional._

1. **Log every agent action** the same way you'd log a privileged user session.
2. **Set behavioral baselines** and alert on deviation, an agent suddenly calling a new API, hitting a system at unusual volume.
3. **Build a kill switch into every agent's deployment**, not as an afterthought but as a launch requirement.
4. **Decommission on a schedule.** Gartner predicts 40% of enterprises will demote or decommission autonomous agents by 2027 because governance gaps surface only after deployment. [14] Catching that earlier means treating agent lifecycle like software lifecycle, with planned retirement, not indefinite runtime.

The swarm-scale version of this problem, where persistent agents overwhelm internal systems, is worth [a closer look](https://goremy.ai/blog/articles/agentic-flooding-protecting-internal-systems-from-ai-swarms), as is the reminder that [a sandbox alone isn't containment](https://goremy.ai/blog/articles/ai-agent-security-why-vms-alone-wont-contain-them).

### Step 5: Turn Policy Into Culture, Not Just Compliance

A policy that only punishes disclosure guarantees employees hide their agents instead of registering them. The data backs this concern: with fewer than 11% of workplace AI tools visible to IT, [3] the incentive structure is broken. Make the [sanctioned path faster and safer](https://goremy.ai/blog/articles/how-to-secure-employee-ai-agent-usage-a-step-by-step-framework) than the workaround, and give employees credit for disclosing what they've built rather than treating disclosure as a confession.

**IT Visibility Into Workplace AI Applications**

|  | Share of AI apps |
| --- | --- |
| Visible to IT | 11% |
| Not visible to IT | 89% |

A governance team that becomes an enabler, not a blocker, actually sees the tools it's trying to manage. That beats a policy that looks strict on paper and gets ignored in practice, which is exactly the gap the ["Free Claude" pattern of shadow tool use](https://goremy.ai/blog/articles/free-claude-problem-managing-shadow-ai-at-work) exploits. [7] For the platform layer specifically, tools like [Remy](https://goremy.ai) are built around giving companies visibility and ownership over the internal software their employees create, rather than treating it as a rogue category to eliminate.

## What Does Waiting on Shadow AI Governance Actually Cost?

The business case for acting now is arithmetic, not alarmism. Shadow AI breaches already cost $670,000 more on average than breaches without it. [9] Sixty-three percent of breached organizations had no AI governance policy at all when it happened. [8] And Gartner's own forecast, 40% of autonomous agents demoted or shut down by 2027 for governance failures discovered too late, [14] is a preview of the rework bill coming for companies that treat this as a someday problem.

The agents your employees are building right now, in HyperAgent, in Agent Builder, in tools nobody has logged yet, are already production software. Govern them like it, or pay for the difference later.

## Frequently Asked Questions

### What is shadow AI governance?

Shadow AI governance is the set of practices IT and security teams use to discover, control, and monitor AI tools and agents that employees build or adopt without formal approval. It includes identity-based access controls, approval workflows for citizen-built agents, and ongoing monitoring, distinct from older shadow IT controls because AI agents can change their own behavior and permissions after deployment.

### How is shadow AI different from shadow IT?

Shadow IT is typically a static, unapproved app, like an employee's personal Dropbox account. Shadow AI increasingly means employees building autonomous agents with no-code platforms that acquire new permissions, spawn sub-agents, and modify their own workflows over time, which breaks the static allowlist and CASB controls built for traditional shadow IT.

### Why do no-code AI agent platforms increase shadow AI risk?

Platforms like OpenAI's Agent Builder and Hyperbrowser's HyperAgent remove the coding barrier, letting business users create agents that call APIs, touch databases, and take autonomous actions without any developer involvement, which means far more employees can build production-grade software that IT never reviews.

### How much does shadow AI actually cost companies?

IBM's 2025 Cost of a Data Breach Report found breaches involving high levels of shadow AI cost $670,000 more on average than breaches with low or no shadow AI present, and 97% of organizations with an AI-related security incident lacked proper AI access controls.

### What is the first step to securing employee-built AI agents?

Discovery. You need a full inventory of every agent and non-human identity in use, since these credentials already outnumber human users by an average of 45 to 1 in most enterprises, before you can apply access controls or monitoring.

## Sources

1. [Shadow AI: The hidden agents beyond traditional governance](https://www.cio.com/article/4083473/shadow-ai-the-hidden-agents-beyond-traditional-governance.html) (CIO.com)
2. [Shadow AI Statistics: Key Data Points Every CISO Needs in 2026](https://airia.com/blog/shadow-ai-statistics-key-data-points-every-ciso-needs-in-2026/) (Airia)
3. [The State of Shadow AI 2026 | Data & Statistics](https://www.unseensecurity.ai/shadow-ai-report) (Unseen Security)
4. [Introducing the Agents API](https://openai.com/index/introducing-the-agents-api/) (OpenAI)
5. [OpenAI launches Agent Builder for no-code AI agents](https://www.linkedin.com/posts/theinformation_openai-makes-it-easier-to-build-agentsand-activity-7381429392348119040-8U8V) (The Information (via LinkedIn))
6. [Introducing HyperAgent: AI-Powered Browser Automation](https://www.linkedin.com/posts/y-combinator_hyperagent-from-hyperbrowser-is-an-open-source-activity-7322652067188133889-GuUh) (Y Combinator (LinkedIn))
7. [2024 Work Trend Index Annual Report (Executive Summary)](https://assets-c4akfrf5b4d3f4b7.z01.azurefd.net/assets/2024/05/2024_Work_Trend_Index_Annual_Report_Executive_Summary_663b2135860a9.pdf) (Microsoft and LinkedIn)
8. [What data leaders need to know from the Cost of a Data Breach Report 2025](https://www.ibm.com/think/insights/data-matters/cost-of-a-data-breach) (IBM)
9. [IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls](https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls) (IBM Newsroom)
10. [The Non-Human Identity Governance Vacuum](https://labs.cloudsecurityalliance.org/research/csa-whitepaper-nonhuman-identity-agentic-ai-governance-v1-cs/) (Cloud Security Alliance)
11. [Taming Shadow IT: Empowering Citizen Developers Safely with Governance](https://www.quickbase.com/blog/taming-shadow-it-citizen-developer-governance) (Quickbase)
12. [AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework) (NIST)
13. [State of Agentic AI Security and Governance 2.0](https://genai.owasp.org/resource/state-of-agentic-ai-security-and-governance/) (OWASP GenAI Security Project)
14. [Gartner Identifies Six Steps to Manage Artificial Intelligence Agent Sprawl](https://www.gartner.com/en/newsroom/press-releases/2026-04-28-gartner-identifies-six-steps-to-manage-artificial-intelligence-agent-sprawl) (Gartner)