Most AI security talk focuses on attackers using models. The quieter problem is tools already inside the org — installed for speed, never inventoried, never owned.
Blog · 2026-10-24
Unmanaged AI agents are an insider risk you already have
Shadow agents on laptops hold API keys and internal reach with no owner. Inventory, secrets scope, spend caps and approval gates for AI tools teams already run — before you call them productivity.
Productivity tools with production reach
Somewhere in your network an AI agent is probably running on a laptop. It may hold API keys, reach internal docs, and act without a reviewer. If a person had that access with that little oversight, you would call it insider risk.
Product agent features need human checkpoints; cloud agents need identity and spend controls. This post is about the third category: shadow agents nobody named in a risk register.
Calling them productivity does not reduce blast radius. Ownership does.
Nobody owns the keys
Agents store tokens for SaaS, cloud and internal APIs. Those secrets often live in local config, browser extensions or chat transcripts — outside rotation habits you use for production.
When the employee leaves, the agent’s keys may not. When the vendor rotates an API, nobody updates the bot. Both failure modes are classic insider and supply problems at once.
Require unique, revocable credentials per tool — not a shared human SSO session copied into an agent profile.
Log which non-human identities exist. If you cannot list them, you cannot revoke them during an incident.
Inventory before you ban
Blanket bans drive agents underground. Start with inventory: which tools, which data sources, which actions, which owners.
Classify by blast radius. Read-only summarisation of public docs is not the same as an agent that can open PRs, change cloud resources or message customers.
Allow a shortlist of approved tools with documented scopes. Offer a golden path so squads do not invent shadow ones.
Revisit the inventory quarterly. AI tooling churns faster than annual security theatre.
Secrets and network scope for agents
Give agents the least network and data reach that still does the job. Internal admin APIs should not be reachable from a laptop agent by default.
Prefer brokered access — short-lived tokens issued by a service you control — over long-lived keys pasted into an agent UI.
Separate personal productivity agents from anything that can touch production credentials. Mixing them is how a demo becomes an incident.
Encrypt and store agent secrets with the same discipline as CI secrets. Local plaintext “for convenience” is unpaid risk.
Human approval where blast radius is high
Define which agent actions are auto-allowed, which need a human click, and which are forbidden. Encode that in the tool or in a gateway — not only in a Slack guideline.
What to put in an AI-use policy that teams follow
Name approved tools, banned data classes (secrets, regulated PII, customer exports), and how to request an exception with an expiry date.
01
Require a named owner for every agent that holds company credentials. Unowned agents get revoked.
02
Keep the policy short enough to read in a standup. Long PDFs nobody opens do not reduce insider risk.
03
Tie policy to delivery: onboarding checklists, laptop builds and vendor reviews should ask about AI agents the same way they ask about VPN access.
How Three Index designs agent access with owners
Our AI & ML work builds product agents and copilots with scoped tools, evaluation and human checkpoints — in repositories and cloud accounts you own.
On the platform side, DevOps and cloud habits — identity, spend caps, audit — apply to automation whether a human or an agent holds the role.
We help teams inventory shadow tooling and replace it with owned paths instead of theatre bans that fail on day two.
Send a brief with the AI tools already in use and the actions they can take. We will propose ownership, scopes and approvals that match the blast radius you actually have.
FAQ
Short answers related to this article.
What is an unmanaged AI agent?
Any assistant or agent running with access to company systems, secrets or data without a named owner, reviewed permissions or spend limits — often installed as a productivity tool on a laptop.
How is this different from product agent features?
Product agents are designed into your software with checkpoints you ship. Unmanaged agents are shadow IT: employee-chosen tools with production-like reach and no security review.
How can Three Index help with agent access design?
We design AI features and delivery habits with owners, scoped secrets, human approval where blast radius is high, and cloud controls so automation stays inside accounts and policies you keep.
Why Three Index
AI-first software company founded in 2020 in Ahmedabad. Fifty-plus IT professionals. More than five hundred projects shipped.
We are large enough to staff serious products and small enough that the people who wrote a module can still explain it. See how we operate, our AI development work, browse case studies, or join the team.
Tell us what you are trying to build.
Send a short description of the project. You will get a reply from someone technical — with questions worth answering, not a brochure.