01 / Below the approved surfaceAn approved model can still sit inside an unauthorised chain

A relationship manager uses an approved enterprise model to draft client briefs. A personal browser automation collects account pages, a shared service credential opens a research system, copied notes persist in a local store and a scheduler posts the finished brief to a team workspace. The approved model appears in the software inventory. The operating chain does not. If the brief shapes a client recommendation, the hidden network reaches a business decision through identity, data, action and persistence that nobody reviewed as a whole.

Shadow agents are often described as unapproved chatbots or subscriptions. That framing misses the network. A sanctioned SaaS application may add a new agentic feature after procurement. A local script may send an approved model's output into a pricing workbook. A personal automation may use a shared credential to take downstream action. A copied prompt, browser profile, spreadsheet or queue may preserve state beyond the model session. Blocking one domain reveals little about the commitments already produced elsewhere.

This article defines a shadow agent network as an undeclared or weakly governed chain of identities, runtimes, context, intermediate state, tools and business effects that acts outside a valid product, delegation or control boundary. Unsanctioned does not imply malicious. Some networks emerge because teams have a real operating need and the sanctioned route is slow, incomplete or inaccessible. Others combine innocent local choices into material exposure no participant can see.

The discovery objective is therefore not to catch people using a brand. It is to determine which identity reads which data, invokes which capability, changes which state, informs or executes which decision, affects whom and persists for how long. That map supports proportionate choices: register, sandbox, formalise, reconstruct or terminate.

02 / The prohibition rivalBlock what cannot be contained, but do not confuse blocking with discovery

The strongest rival is straightforward: disable unsanctioned tools and require all AI work to use approved platforms. Prohibition is appropriate when an activity is unlawful, high-consequence and uncontainable, or when evidence and affected state cannot be reconstructed. A hidden payment-action agent using shared credentials should not remain active while a committee debates its value.

Tool blocking is incomplete as a general strategy. Personal devices, local scripts, embedded features, browser extensions, copied outputs and business processes that consume agent work off-platform can bypass a model-domain control. An approved platform may still be used with a personal scheduler or excessive credential. A block can also destroy evidence if the response deletes local state before investigators understand which decisions or customers were affected.

Prohibition becomes self-defeating when every discovered experiment leads to discipline or a lengthy central queue. Employees learn to conceal useful demand, security receives less context and weak networks persist longer. A rapid intake path, bounded experiment space and sanctioned alternatives are therefore part of control effectiveness. They give teams a safe way to surface need before a local workaround acquires credentials and persistence.

03 / Seven nodesMap the network from identity to persistent consequence

The graph matters because an inventory can list every component and still miss the relationship. A model licence says nothing about the shared credential attached to a browser agent. A data-loss event says little about the pricing workbook that consumed the output. A successful API call does not identify which business purpose or affected population justified the action. Discovery joins nodes into a causal operating path.

Edges are observed claims, not accusations. “Identity X read source Y and later tool Z changed state Q” requires timestamps, identifiers and alternative explanations. Investigators should distinguish direct evidence from inference and should not infer employee intent from technical sequence. The intake process invites the business context that telemetry cannot supply.

The graph should be versioned because shadow networks change during discovery. A user may disable an extension, a scheduler may continue under a service account, or an embedded feature may update its tool behaviour. Record the observation window and confidence for every edge. Distinguish active, suspended, historical and unverified nodes. This prevents a stale snapshot from becoming a permanent allegation and helps incident teams see which pathway can still create consequence.

Ownership attaches at several levels. A business sponsor owns the outcome need. Identity and platform teams own credential and execution controls. Data owners establish permitted context. Product or operations owns the governed service after migration. Security owns incident coordination, not the commercial purpose. Audit may later assure the response without designing it. The intake receipt joins these responsibilities while avoiding the fiction that one central team can own every object in the graph.

04 / Five edge dimensionsTrace what can leak, act, corrupt, accumulate and recover

Scorecards are deliberately avoided. A low confidentiality edge does not offset an unbounded payment authority. A well-logged network does not become acceptable when the principal is unknown. Each material weakness changes the response. Investigators record evidence, uncertainty and the affected part of the graph, then choose controls that shrink or remove that exposure.

Dimensions can worsen one another. Copied sensitive context may outlive the source entitlement, turning a confidentiality issue into a recoverability problem. Shared authority obscures which human approved an action, weakening integrity and remediation. A scheduled low-value action can accumulate until consequence changes class. Review the interaction explicitly and identify the first control that can safely break the chain. Removing an unnecessary scheduler may reduce cumulative action immediately while identity and migration work continue.

05 / Effects-first discoveryUse a sensor mosaic, not a model-brand blocklist

Discovery combines lawful, minimised signals that already support identity, security, data governance and operations. Identity logs reveal service accounts, OAuth grants, shared credentials and unusual delegation. Secrets and token stores reveal unmanaged access paths. Network and SaaS telemetry reveal model or automation services. Endpoint and browser events reveal extensions, scheduled scripts and file movement. Workflow records reveal unexpected state changes. Business controls reveal anomalous prices, communications, payments or decisions.

Signals should identify an operating question, not collect private content by default. A security team may need to know that a browser extension transferred a protected file to an external service; it rarely needs every unrelated page or personal message. Use purpose limitation, transparent policy, role-based access, retention boundaries, redaction and independent review. Where employee monitoring law or consultation applies, discovery must satisfy it before deployment.

Correlate cautiously. A network connection followed by a workbook update does not prove causal use. Create a hypothesis, preserve technical events, seek business context and label inference. Employees should have a safe route to explain the purpose and identify missing nodes. This improves evidence and reduces the incentive to hide useful experimentation.

Start from effects with plausible materiality. A price change without an owned receipt, a service identity used from an unexpected browser, or repeated outbound messages from a local scheduler deserves a graph. A simple visit to a public model website may not. This prioritisation keeps discovery proportional and focuses scarce investigation on authority and consequence. It also reduces false positives from normal research, training or personal experimentation that never enters enterprise data or business state.

Self-reporting remains useful when it is not the only source. Teams know the purpose, local dependency and value hypothesis that logs cannot show. Offer a confidential intake route, time-bound amnesty for good-faith disclosure where policy permits, and rapid technical help to place experiments in a bounded environment. Compare declared graphs with observed effects to improve both. The aim is a more accurate system map, not a contest between surveillance and honesty.

Vendor change management belongs in discovery. An authorised SaaS product can add an agent, memory feature or write-capable integration between formal reviews. Track feature notices, OAuth scope changes, new network destinations, tool permissions and release configuration. A product owner should decide whether the original purpose and controls still cover the new capability. Approval of the application is not blanket approval of every future action it can perform.

06 / Negative controlsFive ways a discovery programme becomes blind or harmful

Approved-model blind spot. The model licence is sanctioned, so monitoring stops there. A personal automation and shared service credential create unauthorised reads and writes around it. The control must inspect the authority and effect chain, not certify the whole workflow through one approved node.

Spreadsheet agent. A scheduled script inserts model output into a pricing workbook that drives customer decisions. No autonomous API call changes price, so tool telemetry looks harmless. The downstream workbook is persistent decision state and belongs in the graph. Containment freezes scheduled writes, preserves versions and traces affected decisions before migration.

Embedded SaaS feature. An authorised application adds an agentic action outside the original review. Procurement inventory has not changed, but capability, purpose and authority have. Version and feature-change monitoring should trigger a fresh graph and contract review rather than inherit approval from the surrounding application.

Punitive discovery. Intake always produces discipline, a ban or months of waiting. Useful demand goes underground and investigators lose the people who understand the network. Separate good-faith disclosure from deliberate evasion, create bounded experimental routes and measure intake response time. Accountability remains, but the process should improve control rather than reward concealment.

Telemetry overreach. A monitoring system captures private content unrelated to the legitimate governance purpose. This creates employee harm and a new sensitive shadow store. Collect event metadata and targeted evidence where sufficient, disclose the purpose, minimise retention, restrict access and provide oversight and correction routes.

07 / Preserve, contain, decideDo not destroy the evidence needed to repair the business

Containment begins with a safe evidence hold. Record identities, grants, tokens, runtime, schedules, data sources, state locations, tool calls, downstream writes and affected decision windows. Snapshot only what is lawful and necessary. Hash or version relevant artefacts, preserve log access and prevent routine cleanup from erasing the path. The aim is to reconstruct business consequence, not to collect a general employee dossier.

Next shrink authority. Suspend schedules, remove broad grants, rotate shared credentials, restrict outbound tools and place the workflow in a controlled environment. In-flight actions and child jobs need explicit cancellation. A shared credential may serve unrelated legitimate work, so replacement identity and continuity should be planned before revocation where consequence allows. High-consequence action can justify immediate stop and safe service interruption.

Create an intake receipt: purpose, sponsor, user population, value hypothesis, identities, tools, data, decision, action, affected population, persistence, consequence, existing evidence, current owner, containment state, migration path and expiry. This receipt turns an incident into a governed demand decision. Security contributes evidence and containment; a business sponsor owns the outcome; product, data, identity, risk and legal roles supply the boundaries their objects require.

The disposition has five routes. A low-consequence experiment may be registered with tight data, action and expiry limits. An uncertain but containable network enters a sandbox while evidence and ownership are established. A valuable repeatable workflow with a sponsor migrates to a governed product or platform. A consequential network with invalid authority is revoked while affected decisions are reconstructed. An uncontainable or unrecoverable high-consequence chain is terminated, including every credential, schedule, memory and downstream dependency.

Reconstruction follows business objects, not only technical events. Identify which briefs, prices, payments, statuses, messages or case decisions could have used the network during the affected window. Join each object to available source evidence and authorised alternatives. Prioritise by consequence and recoverability. A missing log may require a broader review window, but uncertainty should remain labelled rather than converted into an assumption that every case was wrong or every case was safe.

Migration needs an exit test for the shadow design. The governed replacement demonstrates unique identity, purpose-bound context, action controls, monitoring, support, retention, fallback and incident response. Then operators remove browser profiles, tokens, scripts, workbooks, schedules, local memory, copied secrets and undocumented downstream triggers. A period of read-only comparison can help verify completeness, provided the old chain cannot continue to act. The owner signs a receipt that names every retired dependency and any residual evidence retained.

Containment communications should match the facts. Tell affected teams what is paused, why, what work can continue safely, how to preserve evidence and where urgent cases go. Avoid public attribution before evidence and employee process are complete. If customers or regulators require notice, the accountable legal and business roles decide it from the reconstructed consequence. Clear communication prevents well-intentioned users from recreating the network to restore a service they think has merely failed.

08 / Worked discoveryA browser-built relationship brief moves into governed context

A relationship team uses a browser agent to assemble client briefs from internal account pages, licensed research and recent correspondence. The purpose is legitimate and the briefs save repeated search. Discovery begins after endpoint telemetry shows an extension using a broad shared service credential and posting scheduled outputs to a workspace. Investigators preserve extension settings, grant history, schedules, context sources and a sample of receipts without capturing unrelated browsing.

The graph shows sensitive client context, an approved model, local prompt state, browser automation, a shared research credential, scheduled workspace writes and briefs used before meetings. No direct customer action occurs, but provenance is incomplete and broad access exceeds the purpose. The business sponsor confirms value and identifies the meeting-preparation outcome. Security rotates the shared credential, assigns a unique test identity and disables the scheduler while maintaining a manual brief route.

The network enters a sandbox. The team defines eligible client populations, approved sources, retrieval purpose, freshness, prohibited fields, human review, workspace destination, retention and expiry. Historical briefs are sampled against source records; decisions that relied on unsupported claims are identified for correction. A product owner is assigned, and the workflow migrates to a governed context service with case-scoped access, source citations, no local memory and receipt-bearing publication.

Contrast an unsanctioned payment-action agent using shared credentials. It reads inbox requests, generates payment instructions and submits them through browser automation. Transaction history is incomplete, child schedules are unknown and the enterprise cannot tie actions to individual authority. This is not a candidate for gradual formalisation. Payment authority is revoked, sessions and jobs are terminated, credentials rotated, affected transactions reconstructed and every persistence point removed. A sanctioned replacement requires a fresh design and proof, not inheritance from the shadow network.

09 / Interactive instrumentShadow Agent Intake and Containment Console

Describe the observed network. The Console returns a disposition and immediate controls. A high-consequence unrecoverable chain routes to termination; useful low-consequence demand can surface without punishment.

10 / Control that teams will useMake the sanctioned path faster than the shadow path

A durable programme joins security evidence to business ownership. Security cannot own the purpose or value of every discovered workflow. The business sponsor cannot validate identity, data and containment alone. Product and platform teams cannot inherit a hidden chain without reconstructing its dependencies. The intake receipt provides a shared object while keeping typed responsibility intact.

Measure networks found through effects rather than voluntary declaration alone, time from signal to containment, proportion with a named sponsor, affected decisions reconstructed, credentials and persistence removed, migrations completed, repeat discovery, employee challenges and intake response time. Avoid a headline count of shadow tools: better discovery can make the count rise while exposure falls.

Read measures as a portfolio of demand and exposure. Repeated shadow networks around the same data source may indicate that the sanctioned product lacks an essential capability. Many networks using shared credentials may expose an identity-service gap rather than widespread bad intent. Long containment time may reflect unknown persistence or slow business ownership. Trends should trigger product, platform and policy repairs, not only stronger blocking. The programme succeeds when the enterprise learns why hidden chains form and removes that cause where it can.

Review the sanctioned route as a control. If safe experiments require months, if the approved platform cannot access legitimate data under bounded purpose, or if every request needs a committee, local networks will reappear. Provide unique test identities, contained context, approved tools, short-lived credentials, receipts, clear prohibited actions and rapid owner assignment. This does not remove governance; it makes governed action possible before workarounds become operational infrastructure.

Employee trust is part of resilience. Publish what signals are used, why they are necessary, who can access them, how long they remain and how a person can correct a mistaken inference. Distinguish good-faith experimentation, negligent exposure and deliberate abuse through evidence and policy. Do not make the employee the adversary when slow systems, missing capability or unclear ownership produced the demand.

A shadow agent network is removed only when every dependency is addressed. Revoking the model key while a scheduler, shared credential, workbook, copied memory or downstream process remains is partial shutdown. Formalisation also fails if the governed front end retains a shadow data source or local state store. Trace the graph again after migration or termination and confirm that no orphaned edge can still act.

The enterprise will not control agentic work by seeing every prompt. It will control it by making identity, purpose, data, authority, effect and recovery inspectable at the points where business state changes. Effects-first discovery reveals what brand inventories miss. Evidence-preserving containment protects customers and employees. Rapid intake converts useful demand into owned capability. Termination remains available for the networks that cannot be bounded or repaired.

SourcesReferences

1. Haag, S. and Eckhardt, A. (2017), “Shadow IT”, Business & Information Systems Engineering. doi.org/10.1007/s12599-017-0497-x.
2. Behrens, S. (2009), “Shadow Systems: The Good, the Bad and the Ugly”, Communications of the ACM, 52(2), 124–129. doi.org/10.1145/1461928.1461960.
3. Zimmermann, S., Rentrop, C. and Felden, C. (2014), “Managing Shadow IT Instances: A Method to Control Autonomous IT Solutions in the Business Departments”. aisel.aisnet.org/amcis2014/StrategicUse/GeneralPresentations/12/.
4. Silic, M. and Back, A. (2014), “Shadow IT: A View from Behind the Curtain”, Computers & Security, 45, 274–283. doi.org/10.1016/j.cose.2014.06.007.
5. NIST (2023), “AI Risk Management Framework Core”. airc.nist.gov/airmf-resources/airmf/5-sec-core/.
6. Autio, C. et al. (2024), Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. doi.org/10.6028/NIST.AI.600-1.
7. Rose, S. et al. (2020), NIST SP 800-207: Zero Trust Architecture. doi.org/10.6028/NIST.SP.800-207.
8. NIST (2020), SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations. doi.org/10.6028/NIST.SP.800-53r5.
9. Nelson, A. et al. (2025), NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management. doi.org/10.6028/NIST.SP.800-61r3.
10. CISA (2023), Zero Trust Maturity Model Version 2.0. cisa.gov/resources-tools/resources/zero-trust-maturity-model.
11. European Union (2024), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence. eur-lex.europa.eu/eli/reg/2024/1689/oj.
12. ISO/IEC (2023), ISO/IEC 42001: Artificial intelligence management system. iso.org/standard/81230.html.
13. ISO/IEC (2022), ISO/IEC 27001: Information security management systems. iso.org/standard/27001.
14. Basel Committee on Banking Supervision (2021), Principles for Operational Resilience. bis.org/bcbs/publ/d516.htm.
15. Kellogg, K. C., Valentine, M. A. and Christin, A. (2020), “Algorithms at Work: The New Contested Terrain of Control”, Academy of Management Annals. doi.org/10.5465/annals.2018.0174.