# Unmanaged AI agents are an insider risk you already have > Shadow agents on laptops hold API keys and internal reach with no owner. Inventory, secrets scope, spend caps and approval gates for AI tools teams already run — before you call them productivity. - Published: 2026-10-24 - Canonical: https://www.threeindex.com/blog/unmanaged-ai-agents-are-insider-risk - Tags: AI, Security - Related: https://www.threeindex.com/services/ai-ml ## Productivity tools with production reach Somewhere in your network an AI agent is probably running on a laptop. It may hold API keys, reach internal docs, and act without a reviewer. If a person had that access with that little oversight, you would call it insider risk. Most AI security talk focuses on attackers using models. The quieter problem is tools already inside the org — installed for speed, never inventoried, never owned. Product agent features need human checkpoints; cloud agents need identity and spend controls. This post is about the third category: shadow agents nobody named in a risk register. Calling them productivity does not reduce blast radius. Ownership does. ## Nobody owns the keys Agents store tokens for SaaS, cloud and internal APIs. Those secrets often live in local config, browser extensions or chat transcripts — outside rotation habits you use for production. When the employee leaves, the agent's keys may not. When the vendor rotates an API, nobody updates the bot. Both failure modes are classic insider and supply problems at once. Require unique, revocable credentials per tool — not a shared human SSO session copied into an agent profile. Log which non-human identities exist. If you cannot list them, you cannot revoke them during an incident. ## Inventory before you ban Blanket bans drive agents underground. Start with inventory: which tools, which data sources, which actions, which owners. Classify by blast radius. Read-only summarisation of public docs is not the same as an agent that can open PRs, change cloud resources or message customers. Allow a shortlist of approved tools with documented scopes. Offer a golden path so squads do not invent shadow ones. Revisit the inventory quarterly. AI tooling churns faster than annual security theatre. ## Secrets and network scope for agents Give agents the least network and data reach that still does the job. Internal admin APIs should not be reachable from a laptop agent by default. Prefer brokered access — short-lived tokens issued by a service you control — over long-lived keys pasted into an agent UI. Separate personal productivity agents from anything that can touch production credentials. Mixing them is how a demo becomes an incident. Encrypt and store agent secrets with the same discipline as CI secrets. Local plaintext "for convenience" is unpaid risk. ## Human approval where blast radius is high Define which agent actions are auto-allowed, which need a human click, and which are forbidden. Encode that in the tool or in a gateway — not only in a Slack guideline. Spend caps and rate limits belong beside permission lists. Agents that can buy API calls or provision cloud resources need FinOps guardrails. Test refusal. An agent that cannot be stopped is not autonomy; it is negligence with a friendly UI. For product-built agents, keep the same checkpoint mindset described in our note on agentic features — design the approvals in, do not retrofit after a scare. ## What to put in an AI-use policy that teams follow Name approved tools, banned data classes (secrets, regulated PII, customer exports), and how to request an exception with an expiry date. Require a named owner for every agent that holds company credentials. Unowned agents get revoked. Keep the policy short enough to read in a standup. Long PDFs nobody opens do not reduce insider risk. Tie policy to delivery: onboarding checklists, laptop builds and vendor reviews should ask about AI agents the same way they ask about VPN access. ## How Three Index designs agent access with owners Our AI & ML work builds product agents and copilots with scoped tools, evaluation and human checkpoints — in repositories and cloud accounts you own. On the platform side, DevOps and cloud habits — identity, spend caps, audit — apply to automation whether a human or an agent holds the role. We help teams inventory shadow tooling and replace it with owned paths instead of theatre bans that fail on day two. Send a brief with the AI tools already in use and the actions they can take. We will propose ownership, scopes and approvals that match the blast radius you actually have. ## FAQ ### What is an unmanaged AI agent? Any assistant or agent running with access to company systems, secrets or data without a named owner, reviewed permissions or spend limits — often installed as a productivity tool on a laptop. ### How is this different from product agent features? Product agents are designed into your software with checkpoints you ship. Unmanaged agents are shadow IT: employee-chosen tools with production-like reach and no security review. ### How can Three Index help with agent access design? We design AI features and delivery habits with owners, scoped secrets, human approval where blast radius is high, and cloud controls so automation stays inside accounts and policies you keep. ## About Three Index Three Index builds web, mobile, cloud and AI software from Ahmedabad, India. Founded in 2020. - Site: https://www.threeindex.com/ - Contact: https://www.threeindex.com/contact - LLM index: https://www.threeindex.com/llms.txt