Pilot SailPoint Agentic Fabric GA on One Nonproduction Agent

What became generally available on November 4

SailPoint announced general availability of Agentic Fabric at Navigate London on November 4. The company says the product combines Discover, Govern and Protect capabilities for AI agents and other non-human identities, with lineage across a human owner, credentials, entitlements, MCP servers, tools and reachable data.

The announcement describes standalone Standard, Essentials and Advanced offerings, plus Agentic Standard, Business and Business Plus suites. Protect and Non-Human Identity Protect are listed as add-ons in the packaging description. The reviewed public pages do not publish prices, so buyers must confirm entitlement, deployment prerequisites and contract terms directly.

Independent coverage over the preceding two weeks shows broader attention to agent identity governance. Forbes compared SailPoint with other identity and infrastructure providers on October 30 and disclosed the author's industry relationships. Forkast examined the adoption gap on October 24 using vendor and survey claims. Those sources establish active discussion, not product efficacy or market adoption verified by Deep Security.

• What changed: Agentic Fabric is GA with expanded discovery, governance and Protect capabilities.
• Who can use it: organizations can evaluate standalone agent/NHI packages or broader identity suites; exact entitlement requires vendor confirmation.
• Practical task: map and govern one nonproduction agent, then drill a reversible policy response.

Define one synthetic agent and its expected identity path

Choose a nonproduction agent with synthetic data, a dedicated service identity and no production-write access. Document its purpose, business owner, runtime, model provider, credential sources, allowed tools, MCP servers, data stores, destinations, deployment owner and expiration date before connecting discovery.

Keep a known-good inventory outside SailPoint. The pilot is useful only if the team can compare what the product discovers with an independently prepared truth set. Include one intentionally undocumented synthetic credential or tool relationship to test whether the selected sensors and integrations can see it.

Do not enroll a production agent merely to make the demo interesting. Use short-lived credentials, narrow scopes and a separate observer for network, identity and application events.

• Truth set: owner, purpose, credentials, tools, data and expected sessions.
• Safe boundary: synthetic data and dedicated nonproduction identities.
• Success condition: every discovered relationship is explainable, and every planted unknown is handled visibly.

Roll out Discover, Govern and Protect in that order

First, run discovery and compare agent, credential, endpoint, tool and session findings with the truth set. Record false matches, missing relationships, stale data and evidence timestamps. Do not let an inferred owner become authoritative without attestation.

Second, assign the named owner, purpose, lifecycle state and review cadence. Test request, approval and certification workflows with the synthetic identity. Confirm which source system wins when owner or entitlement data conflicts.

Third, enable only the Protect signals and policy actions required for the drill. SailPoint describes behavioral monitoring, inline prompt and response security, automated risk workflows and enforcement. Treat each as a vendor capability claim until your exact integration demonstrates the signal, action, audit record and rollback.

Use an evidence prompt for owner review

If an approved assistant helps the identity team, feed it minimized export rows with stable IDs. Ask it to reconcile relationships and prepare review questions, not to grant access or label an identity safe.

Example prompt: “Using only the supplied Agentic Fabric and source-system rows, produce an owner review packet. List the agent's declared purpose, human owner, credentials, entitlements, tools, MCP servers, data destinations and last activity. Cite each source ID, expose conflicts and stale evidence, and propose read-only follow-up checks. Do not approve access, change a policy, revoke a credential or claim containment.”

The expected output is a cited review packet. The human owner confirms purpose and access, while identity and security administrators resolve discrepancies in the systems of record.

Drill the stop, evidence and recovery path

Seed a harmless policy event, such as an attempt to call a synthetic unapproved tool. Require a security owner to confirm the event and a business owner to confirm impact before the authorized administrator invokes the selected policy action. Preserve product, identity-provider, gateway and application audit records.

Verify from outside the product whether the agent stopped obtaining the credential or reaching the tool, whether queued actions continued and whether another identity path remained. A product status alone is not proof of complete containment.

Recover with a new authorization decision and, when appropriate, a new short-lived credential. Confirm normal operation and record who restored access, why and which evidence supported the decision. Deep Security did not test Agentic Fabric or measure detection or containment performance.

Limitations, availability and buying questions

Discovery depends on the sensors, integrations, telemetry and credential stores actually connected. Local agents, direct tokens, disconnected tools, stale inventories and shared accounts can remain invisible. Lineage can be incomplete or wrong when source ownership is weak.

The November 4 page describes GA and product tiers but does not publish list prices or guarantee that every capability is included in every package. Confirm whether Protect is an add-on, which integrations are supported, where data is processed, what retention applies and how emergency actions are authorized and audited.

Keep existing identity governance, secrets management, gateway, endpoint, network and incident-response controls. Agentic Fabric may help unify evidence and policy, but it does not remove the need for least privilege, independent telemetry, human accountability or a tested manual stop path.