GOV-01: Agent inventory
In short: Keep a single, current list of every AI agent in use, with its platform, identity, tools and the systems it can reach. You cannot govern, review or revoke an agent you do not know exists, and auditors start every review by asking for the list.
1GOV-01
What does GOV-01 require?
Keep a single, current list of every AI agent in use, with its platform, identity, tools and the systems it can reach.
Why does it matter?
You cannot govern, review or revoke an agent you do not know exists, and auditors start every review by asking for the list.
How do you test it?
- Ask for the inventory export and count the agents in it.
- Pick five agents seen in logs or gateway traffic and confirm each one is listed.
- Check that every entry shows platform, identity, tools and reachable systems.
Which platforms document GOV-01?
Documented by NewCore, Silverfort, Astrix Security, Token Security, SailPoint Entro and Clutch Security.
- 9.10NewCore documentedSource: NewCore: Discover, read
- 8.35Silverfort documentedSource: Silverfort: AI Agent Security, read
- 7.30Astrix Security documentedSource: Astrix at RSAC 2026, read
- 6.55Token Security documentedSource: Token Security home, read
- 6.55SailPoint Entro documentedSource: SailPoint agentic AI security, read
- 6.35Clutch Security documentedSource: Clutch Security platform, read
- 7.30Cyera Identity partly documentedSource: Oasis Agentic Access Management, read
- 6.85Descope partly documentedSource: Descope Agentic Identity Hub 3.0, read
- 6.55Aembit partly documentedSource: Aembit home, read
- 5.50Idira partly documentedSource: Palo Alto Networks introduces Idira, read
Which framework references apply?
- NIST AI RMFMap function: Establishing the context and the systems in use. Source: NIST AI Risk Management Framework
- NIST NCCoE agent identityProject scope: identification: How AI agents can be identified. Source: NIST NCCoE: comments on the agentic AI identity concept paper
Which controls are related?
- GOV-02Named accountable owner
- GOV-16Shadow agent detection
- GOV-17MCP server registry
Glossary: agent governance, agent inventory, shadow agent, non-human identity.
Reviewed by The Register desk