Shadow AI agents: the ones nobody registered

Shadow AI agents are AI agents operating inside an organization without having been sanctioned, inventoried, or reviewed by the people responsible for governing them. The agent a team stood up last week without telling anyone. The one built on a laptop with a borrowed API key. The one an approved agent spun up to finish a subtask, which nobody configured and which will be gone by tonight. The one embedded in a SaaS product that quietly gained agentic capability in its last release.

The term borrows from shadow IT, and the parallel is fair. The response most organizations reach for is also borrowed: find them, catalogue them, bring them under management. That response is where this page departs from the usual treatment.

Why shadow agents are different from shadow IT

Shadow IT was unsanctioned software. It stored data where it should not be and created access paths nobody reviewed. The risk was mostly exposure, and finding the software was most of the fix, because once found it could be blocked or brought under policy.

Shadow agents act. They approve, modify, move, and commit. The risk is not only that they exist outside the inventory but that they are making decisions right now that nobody authorized, at machine speed, with whatever permissions they happened to be given. Finding them after the fact does not undo the decisions.

Why you will never find all of them

Discovery is worth doing. It is also structurally incomplete for agents, and we think this part is not controversial.

Agents spawn agents. A sanctioned orchestrator may create a dozen subtask agents during one workflow, none of which existed when the last scan ran and none of which will exist when the next one does.

Agents run on borrowed identities. An agent using a developer's API key looks, to every discovery tool, like the developer.

Agents arrive inside products. A SaaS platform adds an agent feature, a user turns it on, and the organization now has an agent acting on its data that no scan of its own infrastructure will find.

Any inventory is out of date the moment it is written. The scan is a photograph of a population that is changing while the shutter is open.

The control that does not depend on finding them

Our position: since the shadow agent's action still happens whether or not anyone knew the agent existed, the control has to sit where the action happens.

If the check sits in the action path, at the tool call, the API tier, a gateway in front of the system of record, or a sidecar beside the workload, then a shadow agent's action is evaluated because of where the check sits, not because the agent was in an inventory. The refund request from an agent nobody registered is evaluated against the refund policy like any other. If no policy grants it that decision, it does not proceed. If the actor cannot be resolved to a governed identity, that is itself a result: deny or escalate, and record the attempt.

This inverts the usual sequence. Instead of find, register, assign, govern, it is: govern the surfaces where consequential actions pass, and let the shadow agents reveal themselves by trying to act. The ledger becomes a discovery tool of a different kind, one that finds agents by what they attempted rather than by what they look like.

What to do about the ones you do find

None of this is an argument against finding shadow agents. When discovery does find one, the inventory tells you whether to retire it, bring it under a sanctioned identity, or leave it and rely on action-path enforcement. Discovery is an input to those decisions. It is not the control.

Where BotAris fits

BotAris does not hunt for shadow agents. It governs the actions they take. Because the Decision Authority Enforcement Point sits on the surface rather than on the agent, an unregistered agent's action is checked against the Authority Model the same way a registered agent's is. Every attempt, allowed or denied, lands in the Accountability Ledger, which gives the organization a record of shadow agent activity it could not have obtained by scanning.