In one sentence: You can't govern agents you can't count, you can't hold anyone accountable for agents nobody owns, and you can't revoke credentials you never tracked. Fix those three in that order.
Our team spent years inside certificate lifecycle management and secrets, across more than 200 Fortune 500 and Fortune 1000 environments. The same pattern showed up in every one of them: the moment machines started talking to machines at scale, the humans lost the plot. Nobody knew how many service accounts existed. Nobody knew which certs were still valid. Secrets sat in config files, CI pipelines, and Kubernetes objects that three engineers had touched and none of them remembered.
AI agents are that problem again, with a faster clock. CyberArk's 2025 Identity Security Landscape report counts 82 machine identities for every human in organizations worldwide [1]. Agents are about to push that number even higher.
So here's the walkthrough. Four steps, in order. Skip one and the next one doesn't work.
Don't start with the agents you know about. Start with the ones you don't.
Pull every non-human identity from your directories, your cloud IAM, your secrets manager, and your certificate authority. Filter for anything created in the last eighteen months with a name that sounds like a product, a project, or a person's experiment. Then check your LLM API billing. Every key that's spending money is an agent, whether someone filed a ticket for it or not.
You'll find more than you expected. Everyone does. In the 2026 CISO AI Risk Report from Cybersecurity Insiders and Saviynt [2], 71% of security leaders said AI tools already access core systems like Salesforce and SAP, yet only 16% said they govern that access effectively. The gap between those two numbers is your inventory problem.
Write it all down. Agent name, what it does, what it connects to, who built it. Ugly spreadsheet is fine for now. Structured record is the goal.
Every agent in the inventory gets exactly one owner. A person, not a team alias. Not "the platform team." Not the vendor.
The owner's job is simple to state: they know what the agent is supposed to do, they approve what it's allowed to touch, and they're the one who gets the call when it does something else. If nobody will put their name down, that's your answer. Turn it off. An agent nobody will own is an agent nobody is watching.
This step is where most programs stall, because it's a people problem, not a technical one. Push through it anyway. Every downstream control depends on having a name to hold to account.
Now the part our team cares most about.
Issuance. An agent gets credentials scoped to its job and nothing else. Least privilege isn't a nice-to-have here, it's the whole point. If the agent reads tickets, it gets read access to the ticketing system. It doesn't get a wildcard API key because that was easier on a Friday afternoon. Every credential is tied back to the human owner who approved it.
Review. Credentials expire. Set the clock short and make renewal deliberate. When the owner has to re-approve every ninety days, dead agents stop holding live keys.
Revocation. This is where every program our teams have walked into breaks. Agents get decommissioned. Their credentials don't. The cert stays valid, the token stays in the secrets store, the service account stays enabled. Six months later someone finds it, and now it's an incident.
Revocation has to be automatic on decommission. Owner marks the agent retired, every credential it held is pulled in the same motion. Not a ticket. Not a reminder. The same action.
Every credential event, issued, renewed, revoked, gets recorded with the agent, the owner, and the timestamp. Every agent-to-agent handoff gets traced back to the human principal who authorized the chain. When your security team gets asked "what did this agent do and who let it," they answer from the record, not from memory.
Do this right and your SOC 2 evidence generates itself as a side effect. That's not a slogan. That's what happens when the control plane is also the record.
People want to jump to step three because it's the fun technical part. It doesn't work. You can't scope credentials for agents you haven't found, and you can't tie grants to owners who don't exist.
Inventory, owners, credentials, evidence. The loom only holds if you set the frame first.