In a single Tier 1 automotive supplier assessment, we found over 1,200 Shadow MCP Servers running on developer workstations and within R&D VPCs — none registered in the corporate identity store, most authenticated via long-lived OAuth 2.0 client credentials or hardcoded API keys. That number is not an outlier. It is what the LENS™ diagnostic surfaces in nearly every enterprise that has crossed the threshold from AI experimentation into agentic deployment. The Verizon 2026 DBIR documents the consequence: over-privileged machine identities now account for 42% of successful lateral movement cases. The AI agent wave is not creating a new category of risk — it is accelerating a structural governance failure that already existed, at a provisioning velocity your current IGA stack was never designed to match.
The MCP Explosion and the Identity Accountability Gap
The Model Context Protocol has become the de facto standard for connecting LLMs to data sources and tools in under twelve months. The productivity case is real: a single agent can search Confluence, query a Snowflake production schema, and trigger a GitHub Actions deployment — all in response to one natural language prompt. From an IAM perspective, every one of those connections is a service account deployment in disguise.
The identity accountability gap opens the moment those connections are made. Because MCP server instances are not created through HR provisioning or a formal DevOps ticket, they are invisible to SailPoint IdentityNow's joiner-mover-leaver cycles. When the developer who built the agent leaves the organization, the agent — and its high-privilege access to the Snowflake production schema — persists indefinitely. CISA's May 2026 guidance on autonomous AI systems explicitly flags this: agents operating at machine speed with non-deterministic permissions represent a new class of NHI that most organizations are entirely unprepared to govern.
MITRE ATT&CK documents the attack path under T1528 (Steal Application Access Token) — the same technique used against static service accounts now applies directly to MCP OAuth credentials. The NHI governance failure this creates is identical: no inventory, no owner, no rotation schedule, no detection logic built for machine identity behavioral anomalies.
The Accountability Vacuum Your IGA Was Never Designed to Close
Legacy IGA is architected around a single organizing assumption: an identity means a person. The joiner-mover-leaver workflow, the role model, the quarterly certification campaign — every control assumes a human manager who can attest that an account's access is appropriate.
Ask a CISO who owns the MCP server credential used by an LLM agent to access a clinical trial database. They point to the AI team. Ask the AI team. They point to DevOps or the application owner. Ask the application owner. They say it was stood up by a developer during a proof-of-concept sprint and they've never touched it. Ask whether the credential has been rotated. The silence is the answer — the same silence you hear when you ask about any orphaned service account in the environment.
This is not an agentic AI problem. It is the same structural accountability vacuum that makes NHI governance fail for static service accounts, now being replicated at the speed of LLM deployment cycles. The diagram below maps the failure precisely: the horizontal axis represents the agent identity lifecycle from instantiation through decommission; the vertical axis represents ownership clarity. Human identities cluster in the upper-right — governed, attributed, certifiable. Agentic MCP identities scatter across the lower-left — provisioned without owners, persisting without review cycles, accumulating privilege as each new tool connection is added. The gap between those clusters is not a configuration problem. It is a structural accountability vacuum, and it widens with every new agent deployment.
The compliance consequence in regulated environments is unambiguous. In GxP Life Sciences, 21 CFR Part 11 requires strict accountability for who modified a validated record. If an agent modifies a clinical trial database via an MCP tool and the audit log shows ServiceAccount_774a, you have a critical compliance failure — you cannot demonstrate authorized human intent. SOX has the same requirement for financial system modifications. The auditors who accepted "we have a PAM tool" as a sufficient control answer for human privileged access will not accept it for an AI agent that PAM tooling was never architected to govern.
The Agentic Layer Is Compounding This at Sub-Second Velocity
The same distributed non-ownership that makes static NHI governance fail is now being multiplied by agentic provisioning velocity — because agents are designed to be permission-seekers. Without strict guardrails, an LLM agent will find and use any credential it can discover to complete its task.
The IGA/PAM handoff breaks completely under agentic conditions. In a traditional setup, SailPoint governs the request for access and CyberArk manages the credential for that access. Agentic workflows operate at sub-second speeds. An agent may need access to an AWS S3 bucket for exactly three minutes to analyze a log file. Static role assignment creates a permanent vulnerability. Routing every ephemeral access request through a manual SailPoint approval workflow eliminates the productivity gain that justified the agent deployment. Neither tool was architected for just-in-time NHI governance at machine speed — and the gap between what they can govern and what agents actually do is where the accountability vacuum compounds.
Manual governance is structurally incapable of closing this gap at current agent provisioning velocity. The remediation path requires the same three pillars that close the static NHI gap — continuous discovery, immutable ownership attribution, and automated enforcement — applied specifically to the agentic identity surface:
- 1Continuous Discovery: Replace generic
AgentAccountIDs with SPIFFE (Secure Production Identity Framework for Everyone) — short-lived, cryptographically verifiable identities issued to every MCP server and agent runner, traceable to a specific workload and a named human owner. In Entra ID environments, this means federated workload identity via OIDC, not client secrets.
- 1Immutable Ownership Attribution: Implement MCP gateway filtering that inspects LLM tool calls before execution. If an agent invokes a
delete_usercall against an Okta MCP server, the gateway intercepts it and requires real-time human approval via Slack or Teams before the action executes. This is the only architectural mechanism that satisfies "authorized human intent" under SOX and GxP audit requirements.
- 1Automated Least-Privilege Enforcement: Configure SailPoint IdentityNow to ingest non-human accounts from cloud providers and secrets managers on a daily cycle. Use the
signInActivityAPI to flag dormant agents — those that haven't called a tool in 14 days — and trigger automated credential revocation. In CyberArk, create a dedicated Safe for agentic credentials with an automated rotation policy that your SOC can trigger on a suspected model compromise, giving you a documented kill-switch runbook for prompt injection incidents.
Actionable Knowledge Gap: Most enterprises deploying agentic AI have no formal NHI registration process for agent identities — no owner field, no behavior baseline, no rotation schedule. The LENS™ diagnostic surfaces exactly where your program's discovery and attribution controls break down against the agentic identity surface, before your next audit cycle forces the conversation.
Can you name, right now, every AI agent running in your environment — its owner, its MCP server connections, its credential rotation date, and the human who is accountable for its access scope?
Take the Free IAM Posture Assessment — Find Out Where Your NHI Governance Actually Stands
Fayaz Mulla Syed is an IAM and Cybersecurity leader and practitioner who has spent 13+ years at the forefront of enterprise identity — architecting, delivering, and evolving IAM programs across Life Sciences, Healthcare, Automotive, and Telecom. He brings rare depth across the full identity stack: from privileged access and identity governance to zero trust architecture and cloud identity — having worked hands-on in some of the most complex, regulated environments in the industry. He is the founder of IAM Posture™ — a vendor-neutral scoring platform built to cut through vendor noise and give organizations a clear, architectural view of where their identity program actually stands.