Shadow AI Is a Non-Human Identity Problem

## Executive Summary: This advisory explains how "Shadow AI"—AI services and agentic tools integrated into engineering and data workflows—can operate through existing credentials and pipelines, evade browser-based monitoring, and expose source code, CI/CD, credentials, and production data; it recommends establishing behavioral baselines, monitoring credential and vault usage, tracking error/retry patterns, and adopting shared ownership and risk-based governance rather than blanket blocking.