The number of AI agents is growing faster than organizations can identify and manage them. According to IDC forecasts, the global number of AI agents will reach 1.3 billion by 2028.
Whenever a department introduces an AI agent, it often creates another digital identity without fully recognizing the implications. Such identities may have permission to interact with corporate systems, transfer information, and execute actions on behalf of users. Organizations are now trying to establish control over this expanding environment before it becomes unmanageable. The starting point is determining who should be responsible for each agent.
Several departments could potentially assume this responsibility. Legal teams may be expected to establish policies governing how agents handle information. Identity management teams may be responsible for overseeing the growing number of identities as employees deploy agents without submitting formal access requests. Alternatively, accountability may fall to the department manager whose employees developed the agent, based on the principle that the team responsible for its creation should also oversee its operation.
When responsibility cannot be attributed to a specific party, effective ownership may not exist at all. This uncertainty creates conditions in which permissions remain unchecked, access persists beyond its intended purpose, and abandoned agents continue operating.
According to a study by the Cloud Security Alliance, only 15% of organizations have clearly defined responsibility for 76–100% of their AI agents. Meanwhile, 34% of organizations have established responsibility for only 26–50% of their agents. These results highlight a significant gap between the pace of AI agent adoption and organizations’ ability to ensure proper control over them. This situation emerges when a general expectation that someone should take responsibility is never translated into a clearly designated role and a mechanism for verifying that accountability remains in place.
Assigning Ownership Is Only the Beginning. Accountability Requires a Process
Establishing ownership of an AI agent involves more than identifying an individual. It also requires procedures that periodically reassess permissions, withdraw access when it is no longer warranted, and maintain evidence that these actions have been completed.
Without such procedures, ownership exists only formally. A designated person may appear in the records, but there is no operational mechanism to enforce accountability. Assigning responsibility once cannot guarantee that it remains effective indefinitely. Accountability must be repeatedly validated through scheduled reviews and established workflows. These processes need to continue functioning even when the original owner is no longer actively monitoring the agent.
The Consequences of Missing Governance Processes
One example involves software developers running autonomous coding agents directly on their workstations. These tools may be deployed without IT approval and operate outside the visibility of centralized management. However, automatically prohibiting such agents is not necessarily the appropriate response. A more practical approach is to introduce governance procedures that reflect how employees actually use these technologies.
This approach can combine an initial, one-time authorization associated with a particular individual and subsequent periodic access certifications. A 30-day recertification schedule provides a reasonable starting point. Such an interval helps prevent agents associated with completed projects from retaining permissions throughout an entire quarter.
Each review requires an authorized individual to confirm that the existing access remains necessary. Permissions therefore cannot continue solely because an approval was issued during the previous quarter.
This distinction demonstrates why effective governance requires more than an organizational chart identifying responsible individuals. An ownership register records who is accountable at a particular moment. A recurring certification process verifies whether that assignment remains accurate and removes permissions when the conditions supporting access are no longer valid.
How Netwrix Identity Manager Establishes Verifiable Accountability for AI Agents
Netwrix Identity Manager is an identity governance and administration (IGA) solution that has supported the management of non-human identities since 2018, well before AI agents became widely adopted. The solution extends established identity lifecycle management and access certification practices to AI agents. These mechanisms are also used to govern service accounts and machine identities.
Netwrix Identity Manager supports this approach through certification-based automatic access deprovisioning. Permissions assigned to an AI agent undergo recurring certification according to a defined schedule, similar to the access rights of human users.
If the associated project has concluded, the designated owner has left the organization, or the permissions are no longer required, the responsible certifier can decline their renewal. Identity Manager then automatically removes the relevant access rather than allowing it to remain active. Consequently, assigning an owner to every AI agent is insufficient unless the ownership and associated permissions are regularly verified. Agents whose ownership or access can no longer be validated lose their permissions through the established governance process.
Assign Responsible Owners to AI Agents
Review and Certify Access Rights Through Scheduled Campaigns
Conclusion
Effective AI agent governance begins with incorporating every agent into the organization’s identity management framework. Each agent should have an assigned owner responsible for validating its permissions. Regular certification campaigns should then require those owners to confirm continued access at predefined intervals.
When additional expertise is necessary, delegation capabilities can be used to obtain recommendations from colleagues who are more familiar with the agent’s activities. This allows relevant specialists to contribute to the review without transferring final accountability away from the designated owner.
The assigned owner remains responsible for approving access, while the certification process ensures that permissions are evaluated by an authorized decision-maker rather than extended automatically.
Designating an owner establishes accountability at a specific point in time. Continuous governance ensures that accountability remains enforceable as projects evolve, employees change roles, and organizational structures are updated.
