JumpCloud extended its Agentic IAM service this fall, giving IT teams direct control over the autonomous agents already running inside their organizations. The move responds to a gap the company's own survey keeps surfacing: nonhuman identities now outnumber people at most of the organizations it polled, but only a fifth of those organizations have any governance controls around them. The mechanics are straightforward. Agents now sit in the same directory as employees and their laptops, and every agent is tied to a named human owner — an unowned agent will not run at all. JumpCloud tracks each one from creation through retirement, and every registered agent gets a unique identity, which lets an administrator audit what it did or cut off its access without locking out the employee who deployed it. The platform also actively hunts for shadow infrastructure: it looks for Model Context Protocol servers set up outside official channels and routes them through JumpCloud's AI Gateway, applying the same device trust and access policies that already govern sanctioned software. A privileged access management layer is meant to retire the shared API keys agents currently pass around to authenticate themselves. The underlying numbers explain the urgency. Nonhuman identity governance is the weakest of ten recommended AI security practices JumpCloud tracks in its quarterly survey, and the gap between deployment and control has been widening for months — autonomy without human review nearly doubled over six months in earlier editions of the same survey, even as agents moved into financial reporting and HR provisioning. What's notable here isn't the existence of another vendor IAM product — plenty of those exist. It's the specific design choice to make ownership mandatory rather than optional: an agent with no named human behind it simply doesn't execute. That's a narrower, more enforceable claim than most 'governance framework' announcements make, and it maps onto a real documented failure mode — the 'zombie agent' left running with full permissions after whoever built it moved on. Whether a directory-based ownership requirement actually survives contact with how agents get spun up in practice, by developers testing scripts rather than filling out provisioning forms, is the open question. JumpCloud's own data suggests that even well-intentioned teams have struggled to close this gap for most of this year.