As employees adopt unauthorized AI tools faster than companies can monitor them, major technology providers are introducing new systems to control what AI agents can access and do.

WHAT’S HAPPENING

Artificial intelligence is spreading throughout American workplaces, but much of that adoption is taking place outside official company oversight.

According to Okta’s AI Agents at Work 2026 survey, 67% of U.S. workers surveyed reported using AI tools without employer approval.

The findings reveal a growing problem known as shadow AI, where employees introduce personal AI applications, assistants, or autonomous agents into workplace activities without authorization from their employers.

Employees may use these tools to prepare reports, analyze customer information, automate repetitive tasks, or manage daily responsibilities.

While these applications can improve productivity, businesses may have limited visibility into what information employees share, which systems the tools access, or what actions autonomous agents perform.

Technology companies are responding with new governance systems.

In August 2026, Okta, IBM, and Broadcom introduced or expanded enterprise AI management capabilities:

• Okta Agent SSO: Helps organizations establish identity and access controls for AI agents.

• IBM AgentOps: Provides tools for monitoring, evaluating, and managing AI agent operations.

• Broadcom AgentMinder: Focuses on controlling and governing agent activity during execution.

Together, these developments demonstrate a growing effort to bring AI agents under established corporate security and management systems.

However, the availability of these technologies does not mean companies have successfully implemented them.

WHY IT MATTERS

For decades, companies have controlled workplace software through approved applications, employee permissions, cybersecurity policies, and IT management.

Autonomous AI agents introduce a new challenge.

Unlike conventional software, an AI agent may retrieve information, communicate with other applications, execute tasks, and make operational decisions with limited human involvement.

An employee using an unauthorized AI assistant could unintentionally expose sensitive business records, customer information, proprietary documents, or internal communications.

The problem becomes more significant when AI tools can take actions rather than simply provide answers.

For example, an unauthorized agent connected to company email, customer relationship management software, or financial systems could perform tasks outside established security procedures.

Traditional cybersecurity measures may not provide sufficient visibility into these activities.

Businesses must increasingly understand not only which employees have access to company systems, but also which AI agents operate on their behalf.

The challenge extends beyond security.

Employees frequently adopt unauthorized technology because it is convenient, improves productivity, or provides capabilities that approved company software does not offer.

Simply prohibiting these tools may encourage employees to continue using them without disclosure.

Organizations may achieve better results by providing secure, practical AI alternatives while establishing clear rules for access, data protection, and accountability.

The central issue is no longer whether employees are using AI. It is whether businesses can identify, secure, and manage that activity.

WHO BENEFITS

• Employees: Gain access to approved AI tools that can improve productivity without requiring them to bypass workplace policies.

• Businesses: Can strengthen oversight of AI applications, sensitive information, and automated workflows.

• Cybersecurity providers: Gain opportunities to develop AI identity management, monitoring, access controls, and security services.

• AI platform developers: Benefit from growing demand for enterprise-ready agents with built-in governance and accountability.

• IT and compliance professionals: Gain technologies to identify unauthorized tools, manage permissions, and investigate questionable agent activity.

• Customers: May benefit from stronger protections when businesses establish effective controls over AI access to personal information.

WHO LOSES

• Organizations ignoring shadow AI: Face increased exposure to security incidents, data leakage, compliance failures, and unauthorized automation.

• Unapproved AI applications: May lose enterprise usage as companies introduce secure alternatives and enforce access policies.

• Businesses relying on outdated security practices: May struggle to manage AI agents that interact with multiple systems and execute independent tasks.

• Companies with weak AI governance: Risk operational mistakes and financial losses if agents perform actions without appropriate authorization.

• Employees relying on unauthorized tools: May face restrictions or disciplinary consequences when their AI usage violates established workplace policies.

WHAT HAPPENS NEXT

Enterprise AI governance is likely to become a growing area of technology investment as businesses move beyond experimental AI adoption.

Identity management, agent permissions, activity monitoring, and automated policy enforcement will become increasingly important as organizations deploy AI agents across departments.

Businesses will need to determine which AI tools employees are already using, what company information those tools can access, and whether autonomous agents have permission to perform operational tasks.

Clear employee policies and practical approved alternatives will be essential.

Companies may also begin treating AI agents more like digital workers, assigning them defined identities, access privileges, responsibilities, and operating limits.

For technology providers, this creates opportunities to deliver managed AI services that combine productivity with security, compliance, and ongoing oversight.

However, governance software alone will not resolve the problem.

Organizations must also encourage employees to disclose AI usage, provide effective alternatives, and establish procedures for reviewing automated decisions.

The businesses that succeed will likely be those that make authorized AI tools useful and accessible while maintaining meaningful control over company information and operations.

The larger shift is clear: AI adoption is increasingly being driven by employees, while businesses race to establish the systems needed to manage it. The next competitive advantage may belong to organizations that can deliver AI productivity without sacrificing security, visibility, or accountability.