SignorCrypto note · AI
AI Agent Governance for Employees: Controlling Shadow Agents
How to inventory, authorize and audit the agents employees build or connect before they reach company data
Employees now build and connect AI agents on their own, often with the same permissions they hold. Effective governance therefore starts with visibility: a maintained inventory of every agent, a named owner for each one, task-specific permissions, auditable activity records and explicit limits on autonomous action. Standards are still forming. NIST's Center for AI Standards and Innovation (CAISI) opened work on AI agent security in early 2026, but the Cloud Security Alliance (CSA) reported in April 2026 that no enforceable agent-specific security controls existed yet. Organizations need an internal operating model now.
Why employee-built agents are a governance problem
Agents differ from earlier AI tools because they call other tools, send messages and change data across several steps. CSA describes agents that can query databases, send emails, execute code and modify cloud configurations, often with the same permissions as the employees who provisioned them [1]. PwC lists two failure modes that matter here: employees creating unapproved agents to bypass oversight, and agents chaining tool calls to accumulate access beyond their approved scope [2].
What the evidence shows
- CSA cites a 2026 survey of 235 large-enterprise CISOs and CIOs in which 92% lacked full visibility into their AI agent identities, and 95% doubted they could detect or contain a compromised agent [1]. This is a secondary citation of a single survey and should be read as indicative.
- CAISI issued a Request for Information on the security of AI agents on 8 January 2026, and NIST announced its AI Agent Standards Initiative on 17 February 2026. According to CSA, the first substantive NIST deliverables are not expected before late 2026 at the earliest [1].
- The OWASP Top 10 for Agentic Applications 2026, dated 9 December 2025, is a peer-reviewed list of the most critical security risks for autonomous AI systems [4].
A five-control model for employee agents
- Inventory. Record every agent that employees run, connect or build, including the tools and data each one can reach. An agent that is not on the list cannot be reviewed.
- Named owner and defined role. Each agent has one accountable person and a stated purpose. PwC recommends that every agent have a verified identity, a defined role, task-specific permissions and clear limits on autonomous action [2].
- Least-privilege access. Grant permissions per task rather than inheriting the full access of the person who set the agent up. Agents that chain tool calls are the main route to access creep.
- Auditable activity. Keep records of actions, tool calls and approvals so that an incident can be traced to an agent, an owner and a decision.
- Human approval thresholds. Define which actions require review, especially those affecting customers, employees, sensitive data, financial outcomes or legal obligations. PwC advises that human oversight should expand as autonomy increases [2].
Where AI literacy fits
Article 4 of the EU AI Act requires providers and deployers of AI systems to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other persons operating or using AI systems on their behalf. The provision has applied since 2 February 2025 [3]. In agent governance, literacy is the human layer of the model above: employees need to know which agents are approved, what data they may reach and how to report an unexpected action. The Article does not prescribe agent-specific controls. In SignorCrypto's reading, the five controls are one practical way to document that duty.
What remains uncertain
CSA argues that NIST AI RMF 1.0, ISO/IEC 42001:2023 and the EU AI Act were designed before tool-calling agents became common, and therefore contain structural gaps when applied to agentic deployments [1]. A governance programme should be written so that it can be revised as NIST guidance and the OWASP list evolve. The five controls are a synthesis by SignorCrypto of the sources cited here, not a regulatory checklist.
Frequently asked questions
Does governance apply to an agent an employee built for personal use?
It applies whenever that agent can reach company data, accounts or systems. Who built it does not change the risk. Whether a specific obligation applies depends on the jurisdiction and the organization, so check with legal or compliance advisers.
Should companies ban employee-built agents?
A blanket ban can push agents out of view, which makes them harder to govern. An inventory with named owners and approval thresholds keeps useful experiments visible while limiting the access they receive. This is SignorCrypto's analysis rather than a finding from the sources.
Sources
[1] Cloud Security Alliance AI Safety Initiative, The AI Agent Governance Gap: What CISOs Need Now, 3 April 2026.
[2] PwC, AI agent governance for workforce use.
[3] EU Artificial Intelligence Act, Article 4: AI literacy.
[4] OWASP GenAI Security Project, OWASP Top 10 for Agentic Applications for 2026, 9 December 2025.
If your team is moving from individual AI experiments to shared agents, Botchi provides AI assistants and autonomous agents for business teams, with company knowledge and team governance. A useful first step is the inventory: list the agents already in use, who owns each one and which data each one can reach.