Contact Open demo
Solutions / Get started

Zero Shadow Club

A shadow agent is one nobody owns and nobody approved. The Zero Shadow Club is the standard for teams that have none, and the way to get there.

Open the demoRead the standard

Watch the count go to zero

Every agent starts as a row in the inventory. Those without an owner are shadow agents. The standard is reached when the last one is claimed, and stays reached as long as every scan agrees.

The window shows demo data.

AgentsConnected platforms · demo data5 shadow
AgentReached throughOwnerStatus
partner-syncAWS · Lambda roleNo ownerShadow
release-botGitHub · App tokenNo ownerShadow
cursor-ciGitHub · CI secretNo ownerShadow
support-triageOpenAI · API keyNo ownerShadow
docs-summarizerSlack · Bot tokenNo ownerShadow
mcp-mailMCP · OAuth grantOmar HaddadOwned
data-exportAWS · Service accountMaya ChenOwned
Scan finished · agents foundZero shadow

What counts as a shadow agent

Not only agents nobody knew about. Also the ones everybody forgot.

How agents are found
1An agent with no ownerNobody is named as responsible for it.Unowned2An agent whose owner leftThe person who set it up no longer works here.Orphaned3An agent nobody approvedIt runs because a token worked, not because someone decided.Unapproved4An agent nobody re-checksIt was fine once. Nobody has looked at its reach since.Unchecked

The standard

Five conditions. Meet all five on every scan and you have zero shadow agents.

Named owner

Every agent and identity has one person who answers for it.

How nerl0 checks itAn open issue lists each agent without an owner until someone claims it.
Stated purpose

A sentence says what the agent is for.

How nerl0 checks itThe agent record carries a purpose, so a reviewer can tell if its access fits.
Approval

Someone decided that this agent may exist.

How nerl0 checks itApproval is recorded with who decided and when.
Reach checked every scan

What the agent can reach is measured again each time.

How nerl0 checks itEach scan recomputes the paths from the agent to crown-jewel data.
New agents caught the day they appear

A new agent is visible, not discovered months later.

How nerl0 checks itThe next scan flags any agent that was not there before.

These five conditions are nerl0's proposal for the standard.

How teams reach it

Four steps, repeated with every scan.

1Discover

Connect cloud, identity, code and AI platforms. Agents nobody listed show up.

2Assign

Each unowned agent becomes an issue with an owner and a due date.

3Approve

The owner states the purpose. A reviewer approves it, or removes the agent.

4Hold

Every scan measures again. A new shadow agent appears the day it does.

The AWS root access key can perform any action on any resource in the account
Recommended action: Delete the root account access key · Remove access
RemediateAssignCreate a ticket⛓⤓⋮

Detected: The AWS account has a root access key. The root user holds an access key; the root user is not bound by IAM policies and holds every action on every resource. Source: scan e07c354c-4aaa-4e30-b18f-8a1468449688 observed 2026-11-09T06:00:00Z, aws coverage complete.

SeverityCritical
Impact4 crown jewels ·not measurable
Authority paths14 authority paths
EvidenceProvenEvery step is an observed relationship: configured authority. Observed use is reported separately. 2 scans · reproduced
Platforms1 platform
Observed useNo use observedin 30 days of CloudTrail · verify before removing

Every unclaimed agent becomes an issue

A shadow agent is not a vague finding. It is an issue with a severity, a recommended action and a place for an owner, so it can be assigned, worked and closed.

  • OwnerAssigned from the issue, with an owner who answers for it.
  • EvidenceEvery step of its reach is an observed relationship.
  • ClosedThe next scan confirms the change instead of trusting it.

A standard, not a membership

The Club is the name for a state your environment can be in: every agent owned, approved and checked. You can show it with your own scan, and lose it the day a shadow agent appears.

What we do not claim

No member count

The Club is a standard to measure against. We do not publish who has reached it.

No outside certificate

Reaching it is shown by your own scans, not by a stamp from a third party.

No promise about unconnected platforms

nerl0 sees the platforms you connect. An agent on one you did not connect stays invisible.

More solutions

Other ways into the same map of authority.

Browse the Academy

Count your shadow agents.

Open the demoTalk to us