A Guide to Mitigating Shadow AI to Facilitate Agentic AI

Markus Müller, Global Field CTO for API Management at Boomi, joins this episode of Enterprise Unlocked to discuss the threats of shadow AI and enterprise readiness to deal with them. He explains why shadow AI will accelerate much faster than past forms of shadow IT, and how enterprises can prepare to address it. He proposes an approach based on collaboration and sanctioned tools rather than a completely prohibitory one. This episode also covers the importance of AI visibility for governance, the safe level of autonomy for agentic AI, and the best practices of agentic AI adoption. Markus shares his advice for enterprise leaders who want to safely scale AI and defend against shadow AI, including sandbox testing before deployment, coding implicit guardrails into agents’ operating environment, and three core imperatives for enterprise leadership in the agentic AI era. “I have seen cases at customers where people basically exported data from their work laptops and brought it over to their personal devices in order to use AI on them. That creates a second problem: now data is leaving systems that are under full control.” ~ Markus Müller, Global Field CTO for API Management at Boomi Key Questions Answered: • Are enterprises ready for autonomous and proactive types of technology? • How can enterprises tackle Shadow AI, especially as employees continue to adopt powerful but risky agentic AI tools? • How can organizations get a clear view of all their AI agents? • What are the four dimensions of AI autonomy that all enterprises should be aware of? • Can human psychology be applied to agentic AI for us to work better with agents at all? • What are the safe levels of autonomy for AI agents? • How can employees working with AI agents find and frame the right guardrails? • Where do APIs and API management fit into this entire agentic ecosystem? • How do evolving integration standards shape how agents connect to enterprise systems? • How can organizations mitigate the risks arising when agents invoke APIs? • For technology leaders looking to securely scale agentic AI in 2026 and beyond, what are your top recommendations? Key Themes and Takeaways From the Conversation: 1. Enterprise Readiness and the Threat of Shadow AI • Organizations struggle to move AI agents from proof-of-concept sandboxes into real-world production due to the added complexity of governance and integration. • Shadow AI is expanding faster than traditional Shadow IT or Shadow APIs . • Management must understand employees’ workflow needs and offer sanctioned alternatives. 2. Visibility and Asset Governance • Organizations must establish a comprehensive inventory of all active AI agents, accessible tools, and their permissions before attempting to apply governance. • Users often link agents to enterprise systems using personal access tokens, accidentally granting agents unmonitored high-level permissions. • Rather than treating autonomy as a single variable, enterprises must evaluate and tune it across four distinct dimensions: task execution, tool selection, plan execution, and collaboration. 3. Framing Effective Guardrails and Context • AI models possess raw domain knowledge but lack implicit organizational culture, common sense, and internal context. • Implicit corporate guidelines, document standards, and storage rules must be explicitly coded into the agent's operating environment. • Agents should be tested in sandbox environments or digital twins to observe unexpected behavior before live deployment. 4. AI Agents in Organizational Structures • Assigning thousands of AI agents to a single human manager creates cognitive overload, requiring additional "summary agents" to digest status reports. • Enterprises continue to evaluate whether AI agents should be formally listed on company org charts as virtual workforce members or treated strictly as enterprise software tools. Chapters: 00:00 Introduction 01:24 The Shadow AI Challenge 02:07 Enterprise Readiness for AI Agents 02:45 Why Shadow AI Spreads 04:08 Consumer AI at Work 05:22 Building an AI Agent Inventory 06:37 Four Dimensions of Agent Autonomy 09:22 Trust Between AI Agents 11:21 How AI Agents Differ from Employees 13:12 Balancing AI Costs and Value 14:25 Safe Levels of Agent Autonomy 17:07 Setting Guardrails for AI Agents 19:39 Common Sense and Company Context 21:46 AI Agents in the Organization 24:05 Experimenting with AI at Work 25:19 Assessing Enterprise AI Readiness 27:30 Avoiding Off-the-Shelf AI Deployment 28:32 Cross-Department AI Governance 30:12 Using AI to Improve Guardrails 32:15 Why Human Expertise Still Matters 34:11 Humans, Creativity, and AI 35:03 Frameworks for AI Governance 36:08 Three Takeaways for Enterprises 37:57 Continuous Improvement for AI Agents 38:01 Closing Remarks