The AI agent governance conversation has quietly shifted. A year ago the hard problem was finding agents in the environment — the sprawling, uncatalogued population of bots, service accounts, and API keys spun up outside IT's view. That problem is now considered mostly solved. Platforms can detect, list, and classify agents at scale. What's left is harder: assigning a human to answer for each one. NEXIS, an identity governance vendor, put this plainly in a recent post, arguing that the discovery problem is largely solved but the actual question — who is responsible for this agent, what is it allowed to do, for how long, and who checks this afterward — remains unanswered at most organizations. Their framing is blunt: without a named owner, there's no accountability, no matter how good the inventory is. The scale of the problem is what makes it urgent. Non-human identities — agents, service accounts, automated pipelines — now outnumber human identities in enterprises by a factor of 50 to 100, according to the same analysis, a ratio driven partly by the standardization of interfaces like the Model Context Protocol, which has made it trivially easy to wire an agent into internal systems and data. The failure mode isn't exotic. It's the same one identity teams have fought for decades with service accounts, just multiplied: an agent gets built by a dev team outside normal governance workflows, accumulates permissions, and keeps running after the person who built it moves on or leaves. NEXIS's own platform materials describe this as agents becoming 'orphaned' — active, permissioned, and ownerless — and frame the fix as extending the same joiner-mover-leaver lifecycle model used for human employees to agents, rather than inventing a parallel system. This matters because it reframes what 'agent accountability' infrastructure actually needs to do. Attestation schemes, audit trails, and behavior reports are only as good as the ownership chain behind them — a signed receipt is not useful if nobody is on the hook to read it. The governance gap isn't a tooling gap anymore; it's an organizational one, and it's one that regulatory frameworks like DORA and NIS2 are starting to close by not distinguishing between human and non-human identities at all — an agent acting on an employee's behalf carries the same audit-trail exposure as the employee. The practical upshot: enterprises that have solved discovery still have an accountability deficit, and it's the deficit, not the detection, that determines whether an incident involving an agent has a name attached to it afterward.