SUPERVISORY LAYER / AGENT GOVERNANCE
AGENT GOVERNANCE
FILE THR-OBS-010 / OBSERVED / 2026-09-29 / evidence sourced
Identity Is Not Supervision
What comes after Shadow AI Agent discovery and access control?
シャドーAI Agentの発見とアクセス制御のあとには、何が来るか。
Enterprises are beginning to ask where their AI agents are, what they can access, and what they are allowed to do.
A harder question follows:
Should this action be allowed now?
Thesis
Knowing where an agent is, what it can access, and what it can do is necessary.
It still does not answer whether its next action should be allowed.
Source
AI Agentをどう管理する？「シャドーAI Agent」という新課題
LAC / 株式会社ラック · article 2026-09-03
Observed in LAC Mailmagazine Vol.259, 2026-09-29
https://www.lac.co.jp/lacwatch/service/20260903_004969.htmlFallback reference, retained if the article URL does not resolve.
https://cp.lac.co.jp/e/876321/h-service-20260903-004969-html/5dzfj1/1566721428/h/jHlKanfx-3c6Xr90fbtAPxuwRlYCt7q5-3YiA-PX00QPUBLIC SOURCE
LAC describes the emerging problem of organizations losing visibility into AI agents used across enterprise applications.
PUBLIC SOURCE
The article frames agent-management questions around discovering agents, understanding what they connect to, and controlling access.
SHIRO INTERPRETATION
SHIRO & Co. interprets this as a gap between authorization and execution.
SYSTEM INFERENCE
Identity and access controls do not necessarily determine whether an authorized action is appropriate in its current operational context.
Not a quotation from LAC.
OBSERVATORY STRUCTURE
SHIRO & Co. models this remaining decision as a Supervisory Layer using ALLOW / HOLD / DENY.
Observatory model. LAC is not recorded as endorsing this layer.
LAC describes an emerging challenge around identifying and governing AI agents. This page does not record LAC as endorsing SHIRO & Co.’s Supervisory Layer.
The three questions
01 — DISCOVERY
Where are my agents?
Can the organization identify the agents operating across its environment?
02 — ACCESS
What can they connect to?
Which applications, data stores, APIs, tools, and systems can the agent reach?
03 — AUTHORIZATION
What can they do?
Which actions and permissions have been granted to the agent?
04 — SUPERVISION
Should this action proceed now?
Even when identity and permissions are valid, the action itself may require contextual review.
Control stack
Identity Layer
Who or what is this agent?
Access Layer
What can it connect to?
Authorization Layer
What is it permitted to do?
Supervisory Layer
Should this specific action proceed?
Authorization defines capability. Supervision evaluates execution.
The Control Gap
An agent can be authenticated, registered, and fully authorized while still taking an action that is operationally inappropriate.
The missing decision may depend on contextual variables such as these. They are examples, not a required set.
- timing
- scale
- business consequence
- reversibility
- unusual behavior
- human responsibility
- data sensitivity
- external side effects
- policy conflicts
Authorized Does Not Mean Appropriate
Illustrative decision generated from the stated scenario. HOLD is not a universal security conclusion.
A registered AI sales agent has legitimate Salesforce access and permission to update customer records.
Normal action
Update one account after an approved customer interaction.
Potentially abnormal action
Modify 300 customer records at 03:00.
- IdentityVALID
- AccessVALID
- AuthorizationVALID
- Supervisory decisionHOLDillustrative
The action is technically permitted but unusual in timing, scale, and consequence.
From Permission to Decision
- ALLOW
The action is authorized and contextually acceptable.
- HOLD
The action may be legitimate, but context requires human review or additional verification.
- DENY
The action violates an explicit boundary, policy, or safety condition.
HOLD is the critical middle state.
Traditional access systems often force a binary outcome: permitted or blocked.
Agentic systems may need a reversible pause.
Why Shadow AI Agents Matter
Shadow AI Agent is not only a discovery problem.
As employees connect agents to enterprise tools, the organization may face two separate unknowns.
UNKNOWN AGENT
Discovery problem
The organization does not know that the agent exists.
KNOWN AGENT, QUESTIONABLE ACTION
Supervision problem
The organization knows the agent exists but cannot determine whether a specific action should proceed in context.
Discovery reduces invisibility.
Supervision reduces uncontrolled execution.
Who stops an agent that is technically authorized but contextually wrong?
That question sits beyond identity management.
It is a runtime governance problem.
Related concept
The Supervisory Layer
A control layer between agent capability and irreversible execution.
Related observations
The Supervisory Layer
IDENTITY → SUPERVISION. Discovery and access name the agent. The Supervisory Layer asks whether a specific action should proceed.
ALLOW / HOLD / DENY
PERMISSION → EXECUTION. Permission records what an agent may do. ALLOW / HOLD / DENY is the runtime decision about whether this action proceeds.
The Human Reserve
AUTONOMY → REVIEW. A technically authorized action can still be paused for a person who remains responsible for the consequence.
When AI Stops Generating and Starts Deciding
SELECTION → AUTHORIZATION. A constrained next-action choice still requires a Decision Boundary before execution.
Observation boundaries
This page does not claim:
- — A quotation of the Supervisory Layer from LAC.
- — A claim that identity and access management is obsolete.
- — A universal HOLD for every unusual agent action.
- — A vendor comparison.