(This content was summarized from the advice shared in our recent webinar by experts who are securing agent identities at scale. Watch the full webinar here.)
Key takeaways
- A major lesson mentioned in the expert’s webinar was that sequence matters because each control depends on facts the previous step establishes.
- Prove demand with real use cases before formalizing an operating model.
- Have a declared purpose for every agent is what makes every later access decision reviewable.
- Measure an agent’s authority as a total across systems before tuning permissions in any one of them.
- Begin enforcement with the least reversible actions on the highest-authority agents, and defer the rest.
Teams building agent governance programs rarely disagree about which controls belong in the end state. Where programs stall is sequencing, because the controls have dependencies. Enforcement built before ownership has nobody to route an exception to. Permission tuning done before authority is measured optimizes the wrong agents first.
The sequence below treats sprawl, over-permissioning, and missing lineage as one problem observed at different points in an agent’s lifecycle rather than three separate initiatives. Ordered that way, each step lowers the cost of the next.
Before the sequence: let demand define the operating model
Programs that begin with a governance mandate and no agents to govern tend to produce policy nobody applies. One enterprise ran its approach as a five-week delivery experiment rather than a training program, dedicating half of each participant’s time. Roughly 20 teams and close to 100 people took 20 real business problems and tried to solve them with AI.
“It was a shot in the dark, and it produced 14 viable business cases that went to production.”
Venkat Chivukula, VP, Enterprise Applications & AI, ZoomInfo, on the AppViewX panel – Governing AI Agents at Scale
That result is what justified formalizing a center of excellence, and the trajectory afterward is why sequencing matters. Within five or six months the same organization was running its first 15 agents. It now supports a couple of thousand daily AI users and more than 1,000 agents.
One assumption worth discarding early is that adoption will be the constraint. Change management is routinely overestimated here, since technical teams have usually been experimenting well before a platform arrives. The scarce resource is governance capacity, not enthusiasm.
Step 1. Make the inventory an operating asset, not a report
The part that determines whether an inventory holds is what happens after it is produced. One with no maintainer degrades quietly, and the degradation is invisible because the dashboard still loads. Agents are a new asset class in the asset management system, which implies a named team responsible for the register, a defined refresh expectation, and a decommissioning path that reclaims credentials rather than only removing a row.
“The problem never shows up with your first agent. It’s the hundredth agent, and its hundredth connection, and its subagents.”
Sadeq Zabihi, Sr. Director, Cloud Platform & Services, Docusign
Ready for step 2 when: every agent across SaaS, internally built, and endpoint sources appears in one register, and a named team is accountable for keeping it current.
Step 2. Give every agent a unique identity, an owner, and a declared purpose
Three attributes turn an agent from a running process into a governed enterprise asset. The first two are accepted without argument. The third gets skipped, and it does most of the work later.
“The declared purpose is the guardrail. Undefined, the agent can go anywhere.”
Venkat Chivukula, VP, Enterprise Applications & AI, ZoomInfo
A declared purpose is what makes any later access decision reviewable. Without it, every request is evaluated on whether the agent could technically use the access, a question whose answer is always yes. With it, the question becomes whether the access serves the stated function, which the owner can answer.
This step is also where identity debt either accumulates or does not. Left to run independently, teams may create their own service accounts. Centralizing issuance costs little at 15 agents and becomes a significant program at 1,000.
Ready for step 3 when: no agent in the register lacks a named owner and a written purpose, and identity issuance runs through one path rather than per team.
What the first two steps looked like day to day
The five-week experiment, the lab environment, and the center of excellence that came out of both are covered in detail in a 60-minute panel with the enterprise AI leaders who ran them at ZoomInfo and Docusign, alongside AppViewX CEO Archit Lohokare and CTO Kashyap Ivaturi.
Watch Governing AI Agents at Scale →
Step 3. Measure composite capability before tuning individual permissions
This is the step most programs underestimate, for structural reasons rather than careless ones. Access is granted one system at a time, reviewed one system at a time, and each grant looks defensible on its own terms. The failure mode appears only in aggregate. When a single agent holds a modest slice of privilege across several systems, the combined profile becomes considerably more capable than any individual approval implied.
Segregation of duties gets applied to people almost reflexively, and is rarely extended to agents, even by teams that apply it rigorously elsewhere. The assessment has to run system by system while accounting for combined authority across an agent’s models, servers, credentials, and downstream systems.
Two outputs make the effort worthwhile: a written list of privilege combinations that would never be granted to one person, and a ranked shortlist of the highest-authority agents, which is what makes the next step tractable instead of boundless.
Ready for step 4 when: authority is visible as a total per agent rather than as separate grants, and the combinations that violate segregation of duties are documented
Step 4. Enforce at runtime, starting with the least reversible actions
Governance that stops at review produces evidence rather than control. Access reviews assess whether an agent held appropriate privileges at a point in time, which is a different claim from the assertion that it only performed appropriate actions.
“Don’t stop at discovering and governing agents, you have to stop them at runtime.”
Archit Lohokare, CEO, AppViewX
Applying policy across every agent and action category at once is the surest way to stall under review load. A more workable order starts where an unauthorized action is hardest to undo, meaning terminal access, infrastructure changes, and writes to systems of record. Combined with the shortlist from step 3, that produces a small and specific starting scope.
“Remove standing privileges, grant access dynamically based on observed patterns, and apply deterministic privileged access controls to prevent privilege misuse.”
Kashyap Ivaturi, CTO, AppViewX
Standing privilege is the specific thing to retire first. An agent holding authority continuously is exposed for the entire period it holds it, while one granted authority at the moment of a task is exposed only during the task.
Ready for step 5 when: policy is applied before execution for the least reversible action categories, standing privileges are removed from the highest-authority agents, and every enforcement decision is logged.
Step 5. Turn governance into standing evidence
The final step converts everything above into something produced on request rather than assembled under deadline. Agent lifecycle workflows combined with a signal-sharing layer such as the Shared Signals Framework allow access reviews to assess the privileges agents actually hold at runtime, a materially stronger basis than reviewing what was configured. Mapping those controls to SOC 2, the NIST AI Risk Management Framework, and the EU AI Act lets the same data serve internal audit, external auditors, and regulators without a separate exercise for each.
The test is whether an auditor question can be answered from live data. If producing evidence still requires exporting three reports and reconciling them in a spreadsheet, the program has documentation rather than standing evidence.
Complete when: compliance evidence is generated from live runtime data rather than assembled manually, and agent events reach the same detection pipeline as the rest of the environment.
The sequence at a glance
| Step | What it establishes | Signal that it is complete |
| Prove demand | An operating model sized to real usage | Use cases in production justify a standing team |
| 1. Inventory | A maintained register with a named owner | No known agent sits outside the register |
| 2. Identity, owner, purpose | Accountability attached to every agent | Every record has a named owner and a written purpose |
| 3. Composite capability | Authority measured across systems | Segregation of duties violations are documented |
| 4. Runtime enforcement | Policy applied before execution | Standing privilege removed from top-authority agents |
| 5. Standing evidence | Audit answers drawn from live data | Evidence produced without manual assembly |
What to defer, and why
Deferring is a sequencing decision rather than a compromise. Step-up authentication and human approval across every action category will slow a program that has not stabilized its register, because there is no baseline for judging which actions warrant the friction. Broad automated remediation has the same dependency in reverse: without named owners, remediation has nowhere to escalate when the automated action is wrong.
“Start experimenting, and start small. And when you give agents real access, make sure you have real identity in place first.”
Sadeq Zabihi, Sr. Director, Cloud Platform & Services, Docusign
The destination worth designing toward is traceability across the whole action, treating what a person asked an agent to do and what the agent did in response as one event rather than two. That is what allows an organization to scale agent adoption on evidence rather than on optimism.
Hear this sequence from the teams who ran it in production
ZoomInfo and Docusign are further along on agent governance than most enterprises, and both were design partners on AppViewX Agent Identity Security, now in private preview. In a 60-minute panel they cover what an AI center of excellence looks like day to day, how to govern agent identities without standing up a parallel identity stack, and what trusted AI means once it becomes a product decision.
To see how this sequence is supported end to end, explore AppViewX Agent Identity Security.
Tags
About the Author
