Map every AI to the humans and non-human identities behind it, and everything those identities can reach.
Someone stands up an assistant. It needs to read one repository, or one ticket queue, or one storage bucket. The fastest route is an existing service account or an existing user token, because that credential already exists and already works. Nobody is being careless. Minting a correctly scoped credential means a request, an approval, and a wait of days, and the assistant is wanted this week.
An assistant given a token quietly inherits every entitlement that token carries, usually far more than the task ever required. Nothing in the flow forces anyone to scope it down, and nothing reports the gap between what was needed and what was granted. 92 percent of organizations lack full visibility into AI identities, meaning service accounts, agents, and other non-human identities. That figure is about AI identities, not about employee AI use.
Cybersecurity Insiders, sponsored by Saviynt, 2026 CISO AI Risk Report, January 2026. Survey of 235 CISOs, CIOs and senior security leaders at enterprises of 5,000 or more employees.
Without a clear identity graph, a single hijacked agent is a lateral-movement pipeline into production data, code, and SaaS. The agent acquired no new access. It exercised access that was already granted and had simply never been used. That is why this is hard to catch in advance. Nothing anomalous happens, no control fires, and every call the agent makes is authorized.
IAM tools were not built to trace agents, MCP tools, and model calls back to the identity that made them. They answer who is this principal correctly, and what is calling as this principal, and how far does that call reach, not at all.
AIBound resolves every AI back to the identity it operates as, and traces exactly what that identity can reach.
| AI Resource | Identity | Connections | Blast Radius |
|---|---|---|---|
| Cursor Agent | svc-eng-01 | GitHub · Jira · Prod DB | High |
| Sales GPT | amy@corp.io | Salesforce · Gmail | Medium |
| Support Bot | svc-ai-help | Zendesk · S3 | Medium |
| MCP: FS-Read | root shell | / (full disk) | Critical |
| Copilot Chat | dev group (43) | Repo scope | Low |
A blast radius rating is only useful if the scale behind it is published. These are the four tiers as they read against the graph above.
The identity reaches a single scoped surface, and that surface holds no regulated or production data. Copilot Chat, running as a 43 person developer group with repository scope, sits here.
The identity reaches multiple business systems, at least one of which holds customer or employee records. Sales GPT reaching Salesforce and Gmail as a named human sits here, and so does Support Bot reaching Zendesk and S3 as a service account.
The identity reaches production. Cursor Agent, running as svc-eng-01 with GitHub, Jira and production database connections, sits here.
The identity reaches everything, with no boundary left to describe. The MCP filesystem read server, running as a root shell against the whole disk, sits here.
An AI identity graph maps every AI resource to the human or service identity it operates as, then traces every system, dataset, and agent that identity can reach. It answers two questions a permissions list cannot: what is calling as this principal, and how far does that call reach. A permissions list is a static inventory of grants. A graph is a map of reach, which is what determines the damage if the resource is compromised.
Source: Definitional. Derived from AIBound's own live product description on this page. No third party statistic used.
A non-human identity is a credential that belongs to software rather than to a person: a service account, an API token, a workload identity, or an agent's inherited credential. AI agents typically run as one. That is why an agent can hold entitlements without any named individual being accountable for the grant, and why the agent's reach is usually discovered after an incident rather than before one.
Source: Definitional. Scope wording matches Cybersecurity Insiders, 2026 CISO AI Risk Report, January 2026, which defines AI identities as service accounts, agents, and other non-human identities.
IAM platforms govern the lifecycle of identities and their entitlements. They do not observe which AI resource is calling as a given identity, nor which downstream systems that call actually touches. IAM was specified before agents, MCP servers, and model calls existed as callers, so this is a scope boundary rather than a defect. AIBound sits on the calling side of that boundary and resolves the caller back to the identity.
Source: Definitional, plus AIBound's own live claim on this page that IAM tools were not built to trace agents, MCP tools, and model calls back to the identity that made them.
Blast radius is the full set of systems, datasets, and agents a single AI resource could reach through the identity it operates as, assuming that resource were compromised. It is a property of the identity's entitlements, not of the AI tool's intended function. A summarization assistant running as a production service account has a production blast radius even though summarizing is harmless.
Source: Definitional.
Yes. The graph resolves AI resources operating as named human accounts and as service accounts alike, which is why one row in the published example reads amy@corp.io and the next reads svc-ai-help. This matters because the two cases fail differently: a service account has no owner to ask, and a human account carries that person's full standing entitlements into whatever the agent does.
Source: AIBound's own published example table on this page, rows Sales GPT and Support Bot.
We had no idea our agents were running with the same rights as our engineers, until we saw the graph.
See every AI resource, the identity it runs as, and everything that identity can reach, in one view.