Non-human identities now outnumber human users in 83% of organizations, according to JumpCloud's Q3 2026 research of 800 IT leaders across the US and UK. Only 21% have governance controls specifically for them. AI agents are accessing Salesforce, provisioning infrastructure, processing financial transactions, and operating across production environments with no formal registration, no named owner, and no offboarding process.
The article lays out a four-stage framework: discover every agent running across cloud platforms, SaaS integrations, and on-premise systems; register each one as a formal directory identity with a named human owner; enforce least privilege with just-in-time credentials instead of static API keys in environment variables; and audit agent behavior continuously against its authorized scope. The detail worth reading is in the mechanics, specifically how registration solves the Zombie Agent problem, where agents outlive their purpose but retain access indefinitely, and how credential shielding prevents underlying secrets from ever being exposed to the model executing a task.
The framework rests on a single infrastructure premise: fragmented IT stacks make consistent agent governance impossible. JumpCloud's data shows organizations on unified IT environments are five times more likely to deploy agents in business-critical workflows than those running disconnected systems. The concept driving the architecture is Agentic IAM, governing humans, devices, and agents through one control layer. Whether that holds up under scrutiny is exactly what the full report is there to test.
[READ ORIGINAL →]