SailPoint Agentic Fabric
SailPoint Agentic Fabric is an agent governance capability in Identity Security Cloud. It delivers integrated discovery and governance for AI agents and non-human identities across enterprise, endpoint, and browser surfaces, connecting them to human owners and classifying usage against organizational policy. Agentic Fabric includes an interactive onboarding experience, a unified non-human identity registry, embedded Identity Graph, endpoint and browser discovery, ownership and lifecycle controls, and audit-ready reporting.
Onboarding
Agentic Fabric offers a guided onboarding experience that connects the systems Agentic Fabric needs in order to discover AI agents across your environment and correlate them to the people who own them. This allows users to go from first login to activation quickly.
Non-Human Identity Registry
After Agentic Fabric is activated, the non-human identity registry offers users a central place to view and manage their non-human identities. These include agents, applications, accounts, MCP clients, credentials, and endpoints.
For a quick snapshot of the trend of total non-human identities over a selected time window, use the Non-Human Identity Trends widget on the MySailPoint home page. Hover over the graph to view data by day.
An AI agent is a type of non-human identity that represents entities leveraging large language models (LLMs) to perform tasks on behalf of users or other systems. Users can view and manage agents in the agent registry, as well as view an agent's identity graph.
An application is a type of non-human identity that represents a program or service that related non-human accounts are grouped within. These groupings allow users to organize and oversee their organization's non-human accounts. Users can view and manage applications, as well as view an application's identity graph.
Review and manage your organization's non-human accounts, including machine, service, or bot accounts that relate to a program or service.
MCP clients are governed non-human identity assets because they can extend an AI agent's access to tools, systems, data sources, and credentials. Review MCP clients connected to AI agents in your environment.
Review discovered secret-bearing credentials and all endpoints with the endpoint agent sensor deployed for your organization.
Business Apps
A business app is a grouping of non-human identities that represents a single logical application, agent, service, or tool across all its individual instances. A business app can be a collection of applications.
Administrators can declare a business app's sanction status, choosing between sanctioned, unsanctioned, and unknown. These classifications determine which business apps are permitted or prohibited in the organization.
Audit and Compliance
Auditing and compliance reporting provides auditor-ready records for agent inventory, ownership, monitoring, and governance evidence. The reporting includes identity records, action audit trails, and compliance evidence packaging.
Datasets and Resources
SailPoint sources use datasets and resources to aggregate and govern non-human identities, AI agents, MCP clients, credentials, IAM roles objects.
A resource defines one object type from the connected system. It specifies which attributes the source collects, how the source identifies each object, and how the source displays each object.
A dataset groups one or more resources and assigns them one aggregation schedule. When you aggregate a dataset, the source collects every resource in that dataset from the managed system in a single run.
Configuring Agentic Fabric
Ensure you have completed initial setup within Identity Security Cloud before beginning. Refer to Getting Started in Identity Security Cloud for more information.
Have the following information ready. The last three depend on what you select on the Getting Started screen.
- Administrator access to your Agentic Fabric tenant.
- Your identity provider details for either Microsoft Entra ID or Okta.
-
MDM administrator access for:
- Jamf Pro for macOS endpoints.
- Microsoft Intune for Windows endpoints.
-
API credentials for one EDR or SIEM platform.
- An AWS administrator to approve an access delegation request, if you are connecting AWS.
- Client ID, client secret, and domain name, if you are connecting Microsoft Entra as a cloud source.
Onboarding
Agentic Fabric onboarding offers a guided experience that connects the systems Agentic Fabric needs in order to discover AI agents across your environment and correlate them to the people who own them. Select your systems, follow the steps, and move from first sign-on to activation. You can work in whatever order fits, allowing you to skip steps and return to unfinished steps at a later date. Refer to Agentic Fabric Onboarding for more information.
Onboarding steps are:
When completed, your integrations are connected, your sensor artifacts are ready to hand to your MDM administrator, and Agentic Fabric is active and monitoring.
Getting Started
Select the integrations you use in your organization's environment. Your selections determine your onboarding experience based on the integrations you need. Refer to Getting Started for more information.
Connect Identity Provider
Connect your identity provider to provide a simpler login experience for users in Agentic Fabric. This enables Agentic Fabric to detect human identities and correlate them to the AI agents they own. Refer to Connecting Identity Providers for more information.
After activating Agentic Fabric, identity providers can be managed by going to Admin > Security Settings > Service Provider in Identity Security Cloud. Refer to Service Provider Configuration for more information.
Deploy Sensors
Install the endpoint agent on managed devices and push the browser extension so Agentic Fabric can detect AI tools in use. This step produces the artifacts you need to deploy SailPoint's sensors. The endpoint agent and the browser extension are deployed separately, with their own artifacts and configuration.
Endpoint Agent
Configure SailPoint Endpoint Agent Security to discover and monitor AI agent software that is installed and running on your organization's managed laptops and desktops. SailPoint's endpoint agent runs as a background service with no end-user interaction. Discovered agents are added to the Agentic Fabric agent registry that users can review. Refer to Configuring Endpoint Agents for more information.
After activating Agentic Fabric, browser extension sensors can be managed by going to Admin > Global > Agent Settings > Sensors in Identity Security Cloud. Select the Endpoint Agent tab. Refer to Endpoint Agents for more information.
Browser Extension
Configure the browser extension sensor for visibility and support for GenAI governance processes across both managed and unmanaged SaaS environments. It operates in the browser to detect, correlate, and enhance governance of GenAI-related activities, without requiring any end-user configuration or interaction. Refer to Deploying the Browser Extension Sensor for more information.
After activating Agentic Fabric, browser extension sensors can be managed by going to Admin > Global > Agent Settings > Sensors in Identity Security Cloud. Select the Browser Extension tab. Refer to Browser Extensions for more information.
Connect Sources
Connect your cloud platforms as sources so Agentic Fabric can discover and aggregate agents and other non-human identities. If a matching source already exists on your tenant, enable agent discovery on that source instead of configuring a new integration.
Provide read-only access so Agentic Fabric can discover AI agents running on AWS, Azure, and other AI platforms. Refer to Connecting Sources for more information.
After activating Agentic Fabric, sources can be managed by going to Admin > Connections > Sources in Identity Security Cloud. Refer to Service Provider Configuration for more information.
Connect EDR or SIEM
You can connect your endpoint detection and response (EDR) software or Security Information and Event Management (SIEM) solution for agent discovery and monitoring. Data from your EDR or SIEM platform powers AI agent discovery and monitoring. Once connected, Agentic Fabric finds the available data sources automatically. Refer to Connecting EDR or SIEM Platforms for more information.
After activating Agentic Fabric, EDR and SIEM platforms can be managed by going to Admin > Global > Agent Settings in Identity Security Cloud. Select SIEM and EDR Connections from the left panel. Refer to Connecting EDR or SIEM Platforms for more information.
Sanction Business Apps
During onboarding, the Sanction Business Apps page allows administrators to define a business app's sanction status, determining which business apps are permitted or prohibited in their organization. This enables Agentic Fabric to ensure matching agents inherit the same classification. Refer to Reviewing Business Apps for more information.
Review and Activate
Review the connections you've configured before activating Agentic Fabric. Each step displays a Complete or Incomplete status. You can select Edit for a specific step to return to that page and make changes. You can activate Agentic Fabric without all of the configurations set. Refer to Reviewing and Activating for more information.
Post-onboarding Configurations
After activating Agentic Fabric, you can update or complete your configurations through the following actions:
- Configure your identity provider by going to Admin > Security Settings > Service Provider in Identity Security Cloud.
- Deploy sensors by going to Admin > Global > Agent Settings in Identity Security Cloud. Select Sensors from the left panel.
- Update a source's configuration by going to Admin > Connections > Sources in Identity Security Cloud.
- Configure an EDR or SIEM platform by going to Admin > Global > Agent Settings in Identity Security Cloud. Select SIEM and EDR Connections from the left panel.
- Update the sanction status of business apps by going to Agentic Fabric > Business Apps.
Using Agentic Fabric
After you activate Agentic Fabric, continuous monitoring begins. Shadow AI alerts will fire for unsanctioned tools. Identity correlations will update in real time. Your agent and other non-human identity registries will begin populating, depending on the steps and connections you have completed.
Non-Human Identities
The Non-Human Identity Registry provides a single view of enterprise, endpoint, and browser agents. This allows admins to evaluate non-human identities by risk, manage ownership, including identities and Governance Groups, and organize agents into business apps.
Within the Non-Human Identity Registry, you can view:
Agents
The Agents page provides an agent registry of the enterprise, endpoint, and browser agents used throughout your organization. Review the ownership of agents, organize them by business apps, and access an agent's identity graph. Refer to Managing Agents for more information.
Applications
The Applications page allows users to view information about each application, access an application's identity graph, and update or delete an application as needed. Refer to Managing Applications for more information.
Accounts
The Accounts page provides users with a view of your organization's non-human accounts. Review the status, account owner, and non-human identity the account is correlated to. Refer to Managing Non-Human Accounts for more information.
MCP Clients
The MCP Clients page provides users with a central view of all discovered MCP clients connected to AI agents in your environment. MCP clients can be discovered from sources such as endpoint agents, browser extensions, and cloud connectors. Discovery is based on agent configurations, agent activity, and SaaS connector metadata collected through dataset aggregation. Refer to Managing MCP Clients for more information.
Credentials
The Credentials page provides users with a single filterable view of all secret-bearing credentials discovered by Agentic Fabric sensors with their metadata, including owners, status, and source. Refer to Managing Credentials for more information.
Endpoints
The Endpoints page provides users with a central view of all endpoints with the endpoint agent sensor installed, how they break down by operating system type and version, and the average number of agents per endpoint. Refer to Managing Endpoints for more information.
Business Apps
The Business Apps page offers users a central list of their business apps. Administrators can declare a business app's sanction status, determining which business apps are permitted or prohibited in their organization. After a business app's sanction status is selected, matching agents automatically inherit the sanctioning decision of the business app.
This enables admins to observe and track these tools and create actionable reports. Refer to Managing Business Apps for more information.
Audit and Compliance
SailPoint Agentic Fabric auditing and compliance reporting provides auditor-ready records for agent inventory, ownership, monitoring, and governance evidence. Admins can generate framework-aligned reports on a scheduled or ad hoc basis, so compliance teams can demonstrate governance posture on demand. Refer to Managing Audit and Compliance Reports for more information.
Important
Agent Audit organizes evidence from your SailPoint environment to support your compliance and governance efforts. Evidence reports provided by SailPoint reflect only the data available in SailPoint’s platform and may constitute one part of an overall compliance package. Each report should be reviewed and supplemented by your compliance, legal, or audit teams to confirm sufficiency for a given framework.
Settings
After onboarding, manage agent settings in Identity Security Cloud. These settings include sensors and the EDR and SIEM platforms. Refer to Configuring Agent Settings for more information.
Datasets and Resources
Use datasets to aggregate and govern AI agents and other non-human identities such as MCP clients, credentials, and IAM roles. When a dataset is aggregated, the source collects all resources in that dataset from the managed system.
Resources define what to collect and how to represent it; datasets define when to collect (schedule) and which resources run together during aggregation, supporting aggregation, schema control, and owner assignment for governed non-human identities. Refer to Managing Datasets and Resources for more information.
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.