Most companies today are unable to say exactly which AI solutions they are already using.
New tools often emerge where they are needed: in departments, projects, and teams. That’s why transparency is essential before governance can begin. Our Agent Discovery Workshop is here to help you with that.
23% have a formal strategy for AI agent identities
18% rely on their IAM to manage agent identities
40% are increasing their identity security budget due to risks associated with AI agents
Source: Strata Identity Research 2026
Today, an AI agent can modify SAP entries, close tickets, create users, or trigger workflows. This effectively makes it a privileged identity. And every privileged identity requires governance: a designated owner, clear access rights, defined lifecycle processes, and traceable documentation.
Over the years, companies have learned to manage human identities. AI agents are now raising similar questions in a new context. Who is responsible? What permissions are required? How are changes documented? And when is an agent deactivated? Many existing processes and systems often do not yet account for these requirements.
While new assistants, agents, and automations provide tremendous value, they also come with new responsibilities.
Most organizations have established processes for human identities. It is clear who is granted access, who approves it, and how permissions are verified. These structures are often still lacking when it comes to AI agents. This is precisely where the risk lies.
AI agents are increasingly becoming part of productive business processes. They create content, process data, trigger workflows, or access existing enterprise systems. In many organizations, these use cases emerge where they are needed, often faster than existing governance structures can keep up.
As a result, a new category of digital identities is emerging, for which there are often no clear responsibilities, processes, or control mechanisms in place yet.
No owner
Which AI use cases add value in your environment? We independently evaluate options based on your IAM infrastructure and regulatory requirements.
No lifecycle
Many agents are deployed for a specific use case and then remain in operation indefinitely. Permissions, API access, and credentials remain in place even though processes change or the original purpose is no longer relevant. Without defined lifecycle processes, regular reviews are often neglected.
No audit trail
What decisions were made? What systems were used? What actions were triggered? As long as everything is working smoothly, these questions often go unanswered. However, they become relevant at the latest during audits, security incidents, or compliance reviews.
Before responsibilities, policies, or governance structures can be established, it must first be clear what actually exists.
That is why we begin by conducting a structured assessment of your environment. The goal is to create transparency and use that to identify specific next steps.
Step 01 — Recognition
What already exists?
Together, we’ll take stock of your existing AI applications, agents, automations, and integrations. In doing so, we’ll examine both technical systems and organizational responsibilities to gain a realistic picture of your current situation.
Workshops · Architectural Surveying · IAM Analysis
━━━━━━━━━━━━━━━━━━━━
Step 02 — Sorting
Where is action needed?
Not every solution carries the same level of risk. We evaluate existing agents and automations in terms of their access privileges, responsibilities, and importance to critical processes.
This makes it clear which issues should be prioritized and where there are gaps in governance.
Result: Risk Assessment & Prioritization
━━━━━━━━━━━━━━━━━━━━
Step 03 — Organizing
What happens next?
Based on the results of our Agent Discovery, we develop a pragmatic roadmap for the next steps. You will receive a clear assessment of the most important areas for action, as well as specific recommendations for governance, processes, and organizational responsibilities.
Result: Written recommendation for action
A solid foundation for the next steps:
✓ Transparency regarding existing agents
All identified AI agents and autonomous systems with access rights and responsibilities.
✓ Risk assessment
Classification by criticality and priority level. What needs to be addressed immediately, and what can wait?
✓ Identified areas for action
Where are there organizational or technical gaps? In doing so, we also take into account requirements from NIS2, DORA, and other regulatory guidelines, to the extent that they are relevant to your organization.
✓ Prioritized roadmap
Specific recommendations for the next steps based on your existing infrastructure and the results of the agent discovery.
Maybe there are three. Maybe thirty:
Most companies don't know for sure, and that's where the problem lies: First, we need to figure out what already exists. Our Agent Discovery lays the groundwork for finding out exactly that.
Transparency is only the first step: Once agents have been identified, the next question arises: Who is responsible, what permissions do they have, and how will they be managed in the long term? This is exactly where Non-Human Identity Management comes in.
→ More on Non-Human Identities