Someone in sales built an agent last Tuesday. It reads their mailbox, looks up customer records, and answers questions in chat. They shared it with the team because it was useful. It runs on their credentials, with their permissions, and nobody in IT knows it exists.

This is not the shadow IT we know. That was a subscription outside the tenant that did nothing until someone clicked. This one holds an identity, holds live access to business data, and acts on its own.

We follow that agent on stage. We find what is already running in a tenant, watch a second person pull data out of the builder's mailbox, find the wrong name in the audit log, and see what happens when the content it reads contains instructions. Then we fix it: separating where people build from where things run, making the agent act as the person asking rather than the person who made it, and deciding who owns it the day its builder leaves.

The examples are Microsoft. The failure modes are not. Any platform that lets non-specialists attach real permissions to a language model breaks the same way.

You leave with a decision table for agent capabilities, and a way to run the inventory in your own tenant on Monday.

Level 300, ~60 minutes, live demos throughout.

After this session, participants can:
* Inventory the agents running in their tenant and identify which ones hold access that belongs to an individual rather than to the organisation.
* Choose an appropriate identity model for a given agent, and explain what each choice does to the audit trail and to offboarding.
* Apply permission boundaries, sharing limits and approval gates so that safe agent creation is the default path rather than an exception process.