Bringing Shadow AI Under Control: A Practical Checklist for CISOs and CIOs

**Executive summary:** Shadow AI—unsanctioned AI agents, copilots, and API keys—creates hidden privileged identities and rapid data‑exfiltration paths that existing IAM/IGA stacks often miss; the post provides a five‑step plan (discover, classify, integrate into JML, apply least privilege, and prove controls) and a checklist for CISOs to bring AI tools and agents under identity‑centric governance to reduce incident risk.