Find the AI agents built into your third-party apps, map what each one can reach, and flag risky configurations.
Salesforce Agentforce, Databricks, GitHub, Microsoft 365, Snowflake, ServiceNow, and Workday now ship agents of their own. The security review covers the app, but an agent that appears inside it later often isn’t reviewed the same way, and it runs on real identities with real access.
This brief shows how Obsidian identifies these agents, including ones users built, vendors added, or that arrived switched on. It links each agent to the identities it runs as and the tools and data those identities reach, and flags configurations that give an agent more access than its work needs. Findings sit with each app’s other control failures, so your team fixes them the same way.
Read it to see how discovery and governance work, where they end and runtime enforcement begins, and four questions to ask any vendor about in-app agents.