Shadow AI Is an IAM Problem Now, Not a DLP Problem

The first wave of shadow AI panic was about copy-paste. Someone drops a customer list into a public chatbot, security writes a policy, DLP gets a new regex, the CISO sleeps. Fine. That was 2023.

The problem has moved.

What sits inside enterprises now isn't an employee with a browser tab. It's a sprawl of AI assistants, copilots, and home-grown agents that hold OAuth tokens, service-account keys, and — increasingly — delegated access to email, code repos, ticketing systems, and CRM data. Shadow AI stopped being a data leakage story. It became an identity and authorization story.

The distinction matters. Authentication asks who is calling. Authorization asks what they're allowed to touch. Most of the AI integrations being stood up by product teams answer the first question well enough (the user logs in via SSO) and answer the second question with a shrug. The agent gets the user's scopes. Sometimes it gets more, because the integration was built against an app registration with Mail.ReadWrite or repo when Mail.Read and public_repo would have done.

That's not a model problem. That's an OAuth consent problem, and it's been one since RFC 6749 shipped in 2012.

A few patterns are showing up repeatedly in incident reviews:

• Long-lived refresh tokens issued to AI plugins, with no rotation policy and no binding to device posture. RFC 6749 §10.4 basically warned about this.
• Service principals created for "the AI thing" that accumulate role assignments over months because nobody owns the cleanup.
• Agent frameworks that cache user tokens in plaintext on developer laptops so the orchestration can replay calls.
• Consent phishing aimed squarely at AI tool sprawl, where a malicious app asks for the same scopes a legitimate copilot would.

Would MFA have helped? Honestly, mostly no. The user already authenticated. The token in the agent's hands was issued legitimately. What was missing was scope minimization, token binding (see RFC 8705 for mTLS-bound tokens), and any kind of continuous evaluation. Conditional access policies that fire at login don't fire again when an agent calls Graph API at 3 a.m. from a datacenter IP.

The fix isn't a new product category, whatever the vendors at Identiverse told you. It's boring IAM hygiene applied to a new class of principal:

1. Treat every AI agent as a non-human identity with its own lifecycle, owner, and review cadence.
2. Issue narrow scopes. Audit consented scopes monthly. Revoke aggressively.
3. Require short-lived tokens with sender-constrained binding wherever the platform supports it.
4. Log the authorization decisions, not just the authentications, and pipe them somewhere a human will actually read.

DLP still has a job. It's just not the job that matters here.