"Agents get set up by individual employees, hold API keys and keep running after those employees move on." That line comes from Raj Kunnath, president of BetterCloud, in a product announcement on 29 October 2026. It is a vendor talking about its own product, so weigh it accordingly. It is also the most accurate one sentence description of why AI agent lifecycle management has become a governance issue.
The gap nobody owns
BetterCloud announced AI spend tracking and agent lifecycle management for its IT governance platform. The release contains no statistics, and we are not aware of an independent dataset on how many orphaned agents sit inside the average organisation. So this post does not pretend to have one. It argues from how organisations actually operate.
Employees build agents with the tools they have. Those agents hold credentials, run on schedules and touch real systems. Then the employee changes team, resigns or goes on leave. The HR offboarding checklist covers laptops, accounts and building passes. It rarely mentions the agent.
What happens to AI agents when an employee leaves?
Usually nothing, and that is the problem. The credentials stay valid. The schedule keeps firing. The outputs keep landing in inboxes of people who assume someone is watching.
A composite example. A finance analyst builds an agent that reads supplier invoices from a shared mailbox and drafts payment batches, using her own API key. In March she moves to another team. In June a major supplier changes its invoice layout. The agent misreads a column and drafts duplicate payments. Nobody is assigned to the agent, so nobody sees the drafts until a supplier calls about a double payment.
None of that needs a sophisticated failure. It only needs an agent with no owner.
A lifecycle that does not need new software
You can start with a spreadsheet. The stages matter more than the tool.
Register. Every agent gets a record: who built it, what it does, what systems it touches and what credentials it holds. If it is not on the list, it should not be running.
Assign an owner. The owner should be a role, not a named person. When the person leaves, the role still exists and someone inherits the agent.
Scope access. Start from zero and add only what the task needs. At least one governance platform now starts custom agents with no access by default, which is the right instinct.
Review. Review on a schedule and on triggers: a change of owner, a change of model, a change of vendor or a change in the systems the agent touches.
Retire. Revoke credentials, archive the logs, confirm the agent has stopped and close the record. Retirement should be as deliberate as creation.
Why this belongs to governance and not only IT
Revoking an API key is an IT task. Deciding who is accountable for what an agent did last quarter is a governance one.
This is where organisations tend to get stuck. IT can find the agent. Legal wants to know who approved it. The business says the analyst built it for convenience. Without a registered owner there is no clean answer, and that is the answer regulators and auditors will not like.
The direction of travel in Australia points the same way. The Government has said it aims to legislate Australian Standards for AI in early 2027, and the Privacy Act's automated decision making disclosure requirements start on 10 December 2026. Whatever shape those take, AI agent governance in Australia will rest on organisations being able to say what is running and who answers for it.
What This Means for Your Organisation
What we see across organisations is that agent sprawl is rarely malicious. It is helpful people solving their own problems with the tools in front of them. The goal is not to stop that. It is to make sure every agent has a record, an owner and an end date.
A sensible first step is to add one line to your offboarding and role change process: "Does this person own any AI agents or automations?" It costs nothing and it surfaces more than you would expect.
Key Takeaways
- Agents built by individuals tend to outlive their owners because offboarding processes cover people and accounts, not agents.
- Treat AI agent lifecycle management as five stages: register, assign an owner, scope access, review and retire.
- Make the owner a role so accountability survives staff turnover.
- Add an agent ownership question to offboarding and role change checklists today.
How Trusenta Can Help
- AI Governance Register gives you a single record of every agent, its owner, its access and its review date.
- AI Agents & Automation builds agents with scoped access, logging and retirement designed in from the start.
- AI Governance Maturity Uplift helps you put lifecycle controls around the agents that already exist in your organisation.
Conclusion
Agents will keep being built by the people closest to the problem, and that is largely a good thing. What matters is whether the organisation knows they exist and who answers for them when the builder is gone. A register, an owner and an end date will not solve everything, but it closes the gap that most organisations have not looked at yet.
