Why enterprise AI governance begins with identity and visibility
AI agents do not require a new governance philosophy. They require identity governance, Zero Trust and security operations to extend to autonomous identities.
– Richard Astley, Solution Architecture Practice Lead
Capability is not the first question
Enterprise conversations about AI often begin with capability: what an agent can automate, which systems it can connect to and where it can improve productivity. Those questions matter, but they come after a more fundamental one: on what basis should the organisation trust the autonomous identity taking those actions?
An agent that can access information, invoke tools or initiate transactions is not simply another interface. It is a digital actor operating inside a trust boundary. The governance challenge therefore begins with identity, not with the model or the user experience.
Visibility Before Control
The first failure mode is not always malicious behaviour. It is an incomplete inventory. Agents may emerge from approved platforms, departmental initiatives, developer environments and third-party services. If those populations are viewed separately, oversight becomes fragmented.
Microsoft Agent 365 provides a central registry and an administration experience for observing, governing and securing agents. That central view matters because lifecycle, access and security decisions all depend on knowing which agent is in scope.
From Shadow AI to intentional adoption
Shadow AI is best treated as a governance condition rather than a slogan. It describes agents that exist outside established visibility, approval or control processes. The practical response is not to block innovation indiscriminately. It is to create a route by which agents become known, classified and governed.
That route should connect discovery to accountability, identity, access and monitoring. An inventory without an accountable owner is incomplete. An identity without a defined purpose is difficult to review. Monitoring without a retirement process only records accumulated risk.
Zero Trust Remains the Frame
Zero Trust asks organisations to verify explicitly, use least privilege and assume breach. Those principles remain applicable when the subject requesting access is an autonomous agent. Identity provides the subject; policy determines the conditions; telemetry enables reassessment.
Agent governance is therefore not a parallel discipline. It is an extension of the identity and security operating model to a new class of actor.
Where Leaders Should Begin
Start by establishing an authoritative view of the agent estate. Classify agents by purpose, platform, autonomy, data sensitivity and ability to take action. Identify gaps in identity, ownership and telemetry. Then use that evidence to prioritise governance controls.
The measure of readiness is not the number of agents deployed. It is the organisation’s ability to explain which agents exist, why they exist, what they can reach and who can make decisions about them.
Agent adoption rarely arrives as a single programme with a clean boundary. It appears through productivity initiatives, embedded platform features, departmental automation and experiments that become operational before the organisation has decided how they should be governed. That creates a visibility problem, but also a language problem: teams may use the word agent for very different combinations of models, tools, credentials and execution environments.
The practical leadership task is therefore to define the threshold at which automation becomes a governed autonomous identity. A useful threshold is consequence rather than sophistication. If a component can independently access enterprise resources, retain context, invoke a tool, communicate externally or initiate a transaction, it deserves explicit identity, ownership and telemetry even when its underlying logic appears simple.
Consider a reporting function in which analysts have assembled multiple assistants across approved and third-party platforms. One summarises documents, another queries a data service, and a third distributes generated reports. Individually, each appears low risk. Together, they create an operational chain with access to sensitive information and the ability to publish an output that decision-makers may trust.
An inventory that records only the user-facing assistants misses the identities used by connectors, tools and scheduled processes. A useful discovery exercise follows the action chain: what initiates the work, which identity requests each resource, what data crosses each boundary, where content is retained, and which actor can be disabled without disrupting unrelated services. This turns “How many agents do we have?” into the more useful question, “Which autonomous capabilities can create a business consequence?”
Not every agent requires the same control intensity. Classification should consider autonomy, actionability, data sensitivity, reach, reversibility and dependency. An agent that retrieves public information is materially different from one that can alter customer records or trigger a financial workflow. The purpose of classification is not to produce a perfect taxonomy. It is to make control decisions explainable and repeatable.
Leadership should expect the initial inventory to contain uncertainty. Unknown ownership, ambiguous credentials and incomplete telemetry are findings, not reasons to delay. The first governance milestone is a defensible baseline that distinguishes known and approved agents, known but unassessed agents, and suspected or discovered agents requiring investigation.
The strategic choice is whether agent governance will remain a sequence of platform-specific reactions or become part of the enterprise identity operating model. The latter requires a common minimum record, a route from discovery to approval, and a clear authority able to suspend an identity when accountability or evidence is missing.
This is why identity is the beginning of the discussion rather than a technical detail at its end. A first-class identity creates the subject around which policy, evidence and accountability can converge. Without it, an organisation may possess extensive security tooling yet still be unable to answer who acted, under whose authority and with which approved purpose.
Key Takeaways
Treat agent visibility as a prerequisite for governance.
Require distinct identity and attribution for agents that access enterprise resources
Connect inventory to ownership, access and monitoring
Extend Zero Trust rather than creating a separate trust model
Sources
Research validated on 26 August 2026. Product availability, licensing and preview status can change and should be revalidated before publication or implementation.
- Microsoft Entra Agent ID documentation: https://learn.microsoft.com/en-us/entra/agent-id/
- Governing agent identities: https://learn.microsoft.com/en-us/entra/id-governance/agent-id-governance-overview
- Microsoft Agent 365 overview: https://learn.microsoft.com/en-us/microsoft-agent-365/overview
- Condatis, Agent 365 & Entra Agent ID Governance – Discovery & Qualification Guide: Internal document, July 2026
Stay Ahead of Identity, Security & AI Governance
Practical insights, real-world experiences, new research, and exclusive event invitations from the identity specialists helping organisations navigate transformation with confidence.