How to govern AI agents at scale: An expert discussion

Key takeaways

• Governing AI agents at scale requires giving every agent a unique identity, an accountable owner and a declared purpose, then extending identity controls across its full lifecycle, The lifecycle includes discovery, governance, runtime security, and detection. Identity must follow the transaction end to end, not stop at the prompt.
• Let real demand justify the program, the way ZoomInfo’s A100 experiment produced 14 viable business cases before the AI Center of Excellence was formalized.
• Every agentic workflow involves multiple identities and trust handoffs: the person, the agent, the MCP server and the machine identity that executes the call.
• Three capabilities are non-negotiable: unified visibility, policy written as code, and clean fit with the stack you already run.
• Runtime controls are much harder to retrofit, so sequence discovery first, then governance, then guardrails.
• Trusted AI is not an agent that never fails, but an architecture where identity and chain of authority stay in sync, traceable back to a human.

AppViewX recently hosted a webinar on securing AI agent identity at scale. The expert panelists included:

• Venkat Chivukula (VP of Enterprise Applications and AI, ZoomInfo)
• Sadeq Zabihi (Sr. Director, Cloud Platform and Services, Docusign)
• Archit Lohokare (CEO, AppViewX)
• Kashyap Ivaturi (CTO, AppViewX),
• Alex Babar (VP of Marketing, AppViewX) – Moderator

Stream the full conversation →

The experts provided a rare inside look a the creation of their AI Center of Excellence that are past the pilot stage. The discussion focused on practical decisions such as how to build an agentic AI program, which agent identity security capabilities are non-negotiable, and what governance is needed before agent numbers climb.

Let demand justify the program

At ZoomInfo, the AI Center of Excellence (CoE) started as a delivery experiment rather than a formal organization. A program called A100 gave roughly 100 people across about 20 teams five weeks at half their time to solve 20 real business problems with AI. Fourteen of the 20 projects produced viable business cases that reached production. That demand is what justified formalizing the CoE with an operating model, a team and a platform with standards. Today ZoomInfo has a couple thousand employees using AI daily and over a thousand agents.

Docusign grew the same way, through grassroots adoption. Its CoE was started by answering the hard questions first: what does it have access to, how do you control it, how do you govern it, and who pays for it. It then created a lab environment where teams could bring in frontier models, test safely and prove a use case from zero to one, with a platform to scale onto once proven. Change management was an early consideration, but most people, particularly on the technical teams, were already AI-native in their thinking, so adoption required less organizational uplift than expected.

Identity must follow the transaction, not stop at the prompt

Chivukula called identity the connective tissue across every agentic workflow. A person initiates a request. An agent interprets it. The AI application invokes a tool exposed through an MCP server. A downstream workload executes the resulting call under a machine identity.

In Chivukula’s example, multiple identity-bearing actors participate in the workflow, with trust handed off across the chain. His advice is: Identity has to follow the transaction all the way there and back, not stop at the prompt.

The second issue is composite capability. Even small privileges accumulated across multiple systems can give an agent a powerful composite capability. Segregation of duties is applied to humans almost without thinking, and routinely forgotten for agents. Chivukula recommends assessing risk system by system and understanding the full agent supply chain, meaning combined authority across models, MCP servers, credentials and downstream systems. As Zabihi put it, the problem never shows up with the first agent. It shows up with the hundredth agent, its hundredth connection and its subagents.

The non-negotiable capabilities

Asked which capabilities became non-negotiable, Zabihi named three.

• Visibility. Agents were already in the environment in greater numbers than expected, across SaaS, in-house and other deployment environments. One layer has to cover all of it.
• Policy and policy control. Policy decision points, with policies written as code and committed to the CI/CD pipeline, so you can prove they are applied and working as intended.
• Fit with the existing stack. Something that integrates cleanly, rather than another agent-heavy install on every endpoint.

Chivukula added a constraint that governs all three. Agent security must extend the existing environment rather than run parallel to it. Treat agent security as separate, and you end up rebuilding the entire human identity stack a second time. Extend the authorization matrix you already have.

He also set out what every agent needs to be treated as a governed enterprise asset:

• A unique identity
• An accountable owner
• A declared purpose, which acts as the guardrail. Undefined, the agent can go anywhere

Centralization matters alongside this. Without central coordination, teams may create their own service accounts.

Why agents need purpose-built technology

Lohokare described agents as an entirely new identity class: non-deterministic like humans, but ephemeral and operating at scale like machines. An agent also arrives with models, credentials and MCP servers attached, which AppViewX calls an AI Bill of Materials (AIBOM). Those credentials might be service accounts, API keys, OAuth tokens or certificates.

Agents can be configured with elevated privilege, sometimes on behalf of a human user and sometimes with their own identity, and they can misinterpret intent. That leads to privilege abuse without the identity and access lineage needed to reconstruct what happened. Legacy identity controls were designed around human and conventional machine identities, not autonomous agents.

The four pillars of effective agent identity security

Ivaturi explained that AppViewX did not treat sprawl, over-permissioning and missing lineage as separate problems. They are one problem at different stages of a lifecycle, from the moment an agent comes online to the moment it goes offline. Ivaturi has distilled effective agent identity security down to four pillars including:

1. Discovery

You cannot secure what you cannot see, so the layer has to be platform-agnostic and identity-provider-agnostic. New agent platforms appear daily across endpoint tools, cloud infrastructure, SaaS and bespoke agentic platforms. All of it belongs under one umbrella.

2. Governance

Are these agents safe, and can you prove it? AppViewX combines the Shared Signals Framework with agent lifecycle management workflows to help organizations align controls with the NIST AI Risk Management Framework, address the EU AI Act, and produce evidence relevant to SOC 2 examinations. Access reviews assessing whether agents hold the right privileges for the systems they touch at runtime.

3. Security

The security pillar is designed to prevent unauthorized agent actions. Ivaturi described a proxy-less architecture and compared Guardian Agent to a sidecar running alongside the agent, applying centrally managed adaptive policies. AppViewX built guardian agents, a sidecar running natively alongside the agent, watching every action and enforcing adaptive policy from a central engine.

4. Detection

Given the indeterminism of large language models, the assumption is that an agent will eventually do something unpredictable. The detection layer uses the Shared Signals Framework to exchange security signals and Open Cybersecurity Schema Framework (OCSF)-based schemas to normalize events for AppViewX’s detection logic. Events based on OCSF are aimed at catching the behavior before it becomes an identity threat.

Both practitioners agreed on the sequence. Discovery and observability come first, giving a central inventory regardless of where the agent sits. Governance workflows and demonstrable compliance follow, then runtime guardrails. Chivukula noted that if those controls are not in place while proliferation accelerates, they become much harder to retrofit.

To see how to enable each of these essential pillars, schedule a demo for a private preview of the AppViewX Agent Identity Security product.

What trusted AI means in practice

For Chivukula, trusted AI means the identity taking the action and the chain of authority behind the outcome are in sync, which is the deterministic layer needed in a non-deterministic world. It is not believing an agent will never fail. It will fail, and that has to be acceptable. What matters is having the architecture to understand the constraints and respond when it does. For Zabihi, it comes down to accountability, which starts with identity: who the agent is, what it has and what it can access, traceable back to a human.

Lohokare placed the trust problem both upstream and downstream of the model. Upstream, you need to understand the intent an agent was given before it reasons, which is intent-based authorization and intent-based access control. Downstream, once reasoning produces actions, you verify whether the agent is authorized to perform them.

His three steps were to identify the agent consistently, understand the intent expressed to it and evaluate the actions and environments it seeks to access. Govern those three and you can apply least privilege, just-in-time access, and full audit and visibility. Agents need similar security primitives: cryptographic identity; scoped, short-lived credentials, including expiring certificates; and audit trails that preserve identity lineage.

Top advice for securing AI agent identities

The experts on the panel shared important advice for enterprise rolling out AI CoE programs. Here are a few highlights from the almost hour-long discussion:

• Zabihi: Start experimenting and start small, and when you give agents real access, make sure real identity is in place first.
• Chivukula: Identity has to follow the full journey of the human action and the machine action together, because what you asked the agent to do and what the agent did are one action, not two. Traceability is what gives a company the confidence to scale.
• Lohokare: Do not stop at discovering and governing agents. Zero trust only works when it covers the end-to-end access lifecycle, from discovery and unique identity through governance to identity-aware policy and anomaly detection.
• Ivaturi: Start by giving each agent a unique, verified identity. Then at runtime, remove standing privileges, grant access dynamically based on observed patterns, and apply deterministic privileged access controls.

Frequently asked questions

What makes an AI agent a distinct identity class?

An agent is non-deterministic like a human, but ephemeral and operating at scale like a machine. It also arrives with models, credentials and MCP servers attached, which AppViewX calls an AI Bill of Materials (AIBOM). Legacy identity security was built for humans and machines that behave differently.

What should an enterprise put in place first?

Discovery and observability, giving a central inventory of agents regardless of where they sit. Each agent then needs a unique identity, an accountable owner and a declared purpose. Governance workflows follow, then runtime guardrails, which are much harder to retrofit once proliferation accelerates.

Why does identity need to follow the transaction?

A single agentic workflow involves multiple identities and trust handoffs: the person who initiates the request, the agent that interprets it, the MCP server that invokes a tool, and the machine identity that executes the API call. Identity that stops at the prompt cannot account for what happened downstream.

Watch the full session

The full webinar, entitled Governing AI Agents at Scale: Lessons from the Leaders Who’ve Done It, covers why we need a zero trust approach to securing AI agents, and how AppViewX is building purpose-built identity security for AI agents as a distinct identity class.

Stream the full conversation →