Not autonomy. Democratisation.
Section 04 of the ARISE Playbook asks three questions. The first is the one most programmes get wrong:
Where is AI already touching your core business processes?
The planned trigger is usually “when we deploy autonomous agents.” Fully autonomous standalone agents are still rare. Agents connected to enterprise systems by ordinary employees are not.
The moment someone in Finance connects Claude Cowork to the general ledger, or someone in Sales points Copilot at the CRM, an AI agent is operating inside a core business process with that employee’s full permissions and no one reviewing each action. No deployment plan was filed. No owner was assigned. Nothing is watching it. That is the trigger. Not autonomy, democratization.
Gravitee’s 2026 State of AI Agent Security Report, cited throughout the Playbook, found only 14.4% of AI agents go live with full security and IT approval. BYOA – bring your own agents – is the default state, the Playbook’s analogue to BYOD with a nastier property: the asset acts, has no fixed footprint, and leaves logs that show what happened without showing whether it was authorised.
This post in our ARISE series is requirement one: discovery without prior knowledge. A programme that relies on self-registration governs the agents who behave. The rest are the risk.
You probably already own the first scan
The Playbook’s best page might be “start before you buy anything.” None of this is a platform RFP:
- Query EDR for AI desktop apps, local model runtimes, local tool servers. Most teams have never run it. You get an unofficial inventory in an afternoon.
- Pull MDM application inventory for AI clients and browser extensions, including installs without a ticket.
- Review OAuth grants in the IdP. Filter third-party consents for AI vendors. Watch scopes and tokens with no expiry. This is where most agent access actually lives.
- Audit long-lived API keys issued to AI tools or AI-built integrations. Any key without a named owner is an ungoverned agent identity waiting to happen. See borrowed credentials and token rotation.
- Check which SaaS platforms turned AI on by default. Vendors have shipped agent features into tenants that never requested them, with access to data already in the platform.
- Add one question to change review: does anything in this workflow call an LLM, and whose credentials does it use?
SACR’s three archetypes tell you where the misses will be. Homegrown agents in Bedrock or LangChain at least live near engineering. SaaS agent platforms (Copilot Studio, Agentforce, ServiceNow) are where maker identity goes acute. Local workforce tools – Cursor, Claude Code, Windsurf – are the fastest-growing and least visible: they often skip corporate proxies, skip cloud IAM, and keep secrets in plaintext on the endpoint. That is the largest blind spot in most programmes, and it is why MCP security cannot only be a cloud gateway conversation.
Pingree’s negligence framing in the fireside is harsh and, for a CISO, useful: “I don’t know what I don’t know” is a weak defence when the agents are already in Finance. You are liable for them. Budget guidance from that conversation was not “wait for the winning car” – it was get a real allocation in the seat, because 17x adoption against paltry AI-security spend is how you get surprised.
Discovery that goes stale is not a programme
Requirement two in the Playbook: identity lifecycle. Discovery is a snapshot the moment you take it if agents are created, forked, and retired at intern speed. Continuous inventory – EDR scheduled scans, IdP grant monitoring, SaaS interrogation – is the job. Point-in-time is a board slide.
Cyata, Entro, Token, Runlayer Watch, Microsoft’s directory-native Agent ID: SACR’s vendor section is full of products that find agents across endpoint, browser, SaaS, and cloud. Use one if the estate is large. RequestRocket will not replace them. We do not fingerprint Bedrock agents or crawl CrowdStrike for claude.exe.
What we do after you have the list is make the API side of BYOA expensive to skip.
Containment at the credential chokepoint
Endpoint discovery answers “what is running.” It does not stop the next call to Stripe. If the vendor key still sits in the employee’s env file, you have a named problem and an open door.
The containment move: migrate the upstream credentials the shadow estate depends on into a vaulted target, rotate the old copies, and issue caller identities only through the proxy. Agents that were using the shared key either come into governance or they break – which is the point. Shadow that keeps working is not shadow you found. It is shadow you blessed.
That is complementary to MDM enforce modes (Runlayer Watch’s pattern: detect, then intercept). You can block unapproved MCP binaries on managed devices and make the SaaS secret they wanted useless outside the proxy. Defense in depth, not a religious war between endpoint and API.
For the agents you then register, do the Playbook’s Step 2 immediately: owner, intent baseline, least agency. A discovered agent that keeps the Finance user’s full OAuth scope is a documented intern with a master badge. Scope collapse is how that stays a failure mode.
Edge AI versus core process
The Playbook is not hysterical about every chatbot. Summarisation with no write access and a human on every output can stay on existing governance. Everything touching Finance, HR, Operations, Sales, or IT – where the agent can read sensitive data or take action – is where the five failure modes manifest.
If the honest answer to “how many agents are running” is “we think we know,” you have a discovery problem that makes every other ARISE question unanswerable. Question three in that section is whether you can see blast radius and drift before the incident. On-demand review is built for identities that change slowly. Agents do not.
Next steps
Run the six Playbook queries this week. Bring the real number to the meeting, not the approved number. Then pick the vendor keys those clients are using and move them. Implementation without theatre is tomorrow’s three steps.
Start for free once you have a key you are ready to stop sharing.