When employees can build agents in a few clicks, you will have agents you did not approve. A workable minimum is to find them, register them with an owner, give them narrow default access and ask for review only when risk rises. A ban pushes the work out of sight, which is worse.
How shadow agents appear
Someone connects a mailbox to an automation, grants a calendar and a drive, and the agent starts summarizing and replying. It runs on their login. It is useful, it is not in any inventory, and when the person leaves it may keep running.
The risks are plain. The agent holds the builder's credentials, reads data nobody classified, and may send content to a third party service. And if it reads untrusted email while holding private data and the power to send, it has the combination described in the Agents Rule of Two.
Step one: find them
You cannot govern what you do not see. Useful sources:
- OAuth grants and app consents in your identity provider.
- A list of connected apps in your core SaaS tools.
- Expense reports and card spend on automation and AI services.
- A simple form: "Tell us about the agent you built", with an amnesty period.
Step two: register with an owner
Keep a short registry with a few fields: name, owner, purpose, data it reads, actions it can take, tools and connectors, and date of last review. When an owner leaves, the agent is reassigned or switched off.
Step three: set tiers
| Tier | What it can do | Process |
|---|---|---|
| Personal | Reads only the builder's own non sensitive files | Register, no review |
| Team | Reads shared data, drafts outputs | Light review, owner named |
| Sensitive | Touches customer or regulated data, or sends externally | Full review before launch |
Step four: safe defaults
- Agents run under a scoped identity, not a personal one, once past the personal tier.
- External sending is off unless approved.
- Connectors come from an approved list.
- Logs are on.
Step five: make the safe route the easy route
If registering takes a week, people will skip it. Offer a template with the defaults already set and a one day review for the team tier.
Where Safeguard fits
Safeguard's asset discovery and agent identity features are meant for this problem: finding agents and MCP servers in use and giving each a scoped identity, with policies and guardrails to enforce the defaults.
Quick check
Should we ban employee built agents?
A ban rarely works. Registration, tiers and safe defaults give you visibility and let low risk uses continue.
What is the first thing to do?
Find what exists, using OAuth grants, connected app lists and a self report form.
Last reviewed: 19 October 2026.
