Building an agent inventory

Why is the inventory the first control?

Every governance question starts with a list. Which agents exist? Which ones touch customer data? Which ones nobody has reviewed? You cannot answer any of these without an inventory, and an auditor will ask for it first.

The inventory is control GOV-01 in the register. It carries the inventory area, weighted at 15 of 100 points. That weight understates its role. Ownership, review, approval and decommissioning all assume the agent is on the list. A missing agent escapes every other control at once.

What should each entry contain?

Keep the record small enough that people fill it in, and complete enough that it answers an auditor. A workable entry has these fields.

• A unique agent ID and a human-readable name.
• The platform the agent runs on, such as a copilot, an agent framework or a SaaS feature.
• The identity it uses: service account, workload identity, token or delegated user session.
• The named accountable owner and a backup owner.
• A purpose statement: what it is for, in a sentence or two.
• The tools and MCP servers it can call.
• The data classes it may read and write.
• A risk tier.
• The date it went live and the planned end or review date.

Resist adding more fields at the start. A short entry that is current beats a long one that is stale.

Where do agents actually live?

Agents appear in more places than most teams expect. A good discovery sweep looks in at least six.

• Identity providers, where agents may be registered as applications or agent identities.
• Cloud accounts, where agents run as functions, containers or managed agent services.
• SaaS platforms with built-in agents, such as CRM, ticketing and productivity suites.
• Code repositories and CI/CD pipelines, where agent frameworks and keys live.
• Secret vaults, where agent credentials are stored.
• Endpoints, where developers run local agents with personal tokens.

Vendors in the register cover different sets of these places. Clutch Security connects to clouds, SaaS, code, CI/CD, vaults, endpoints and AI platforms. SailPoint Entro inventories across cloud, SaaS, SDLC and endpoints. Astrix Security describes four discovery methods. NewCore uses read-only integrations and traces access paths outside SSO.

How do you find shadow agents?

A shadow agent is one nobody registered. It usually began as an experiment. Someone connected an agent to a mailbox with a personal token, it proved useful, and it kept running.

Shadow agents are control GOV-16. Finding them needs discovery that does not depend on registration. Asking teams to declare their agents finds the agents people remember. It misses the rest.

Three signals help. First, tokens issued outside single sign-on, such as personal API keys or OAuth grants to unknown apps. Second, traffic to model APIs or MCP servers from accounts with no registered agent. Third, service accounts whose activity pattern looks automated and constant.

When you find a shadow agent, do not delete it straight away. Find the person who created it. Either register it properly with an owner and purpose, or retire it with notice. Deleting first teaches people to hide agents better.

Who should own the inventory?

The inventory itself needs an owner, usually the security or identity team. That team runs discovery, chases missing fields and reports coverage. Each agent entry is owned by the agent's accountable owner, who keeps purpose and access accurate.

This split matters. Security cannot know what every agent is for. Agent owners cannot see every place an agent might be hiding. Together they keep the list honest.

How do you register MCP servers?

Agents increasingly reach tools through MCP servers. Each server is a door into a system. Keep a separate registry of servers, with endpoint, owner and environment, and block connections to servers not on it. This is control GOV-17.

NewCore documents an MCP server connection registry with endpoint, owner and environment. Silverfort runs an MCP Gateway that every tool call hits first. Token Security and SailPoint Entro discover or track MCP servers. Treat the server registry as part of the inventory, linked from each agent entry.

How do you keep the inventory accurate?

An inventory decays from the day you finish it. Four habits keep it current.

• Register before access. No agent receives credentials until it has an entry and an owner.
• Discover monthly. Run discovery on a schedule and compare results with the list.
• Review quarterly. Owners confirm their agents still exist, still serve the purpose and still need their access (GOV-15).
• Retire on completion. When a task ends, decommission the agent and mark the entry closed with a date (GOV-12).

Measure coverage as a number. The share of discovered agents that are registered with an owner is the single best health measure for the inventory. Put it on the board one-pager every quarter.

What does good look like?

A strong inventory has three properties. It is complete: discovery finds few agents that are not already listed. It is owned: every entry names a current employee. And it is linked: each entry connects to the agent's policies, approvals and audit trail. A reviewer can move from the list to the evidence in a few clicks.

In the register, inventory scores range from five to ten. The top scores go to platforms that discover agents without relying on teams to register them, across many kinds of system. Lower scores go to platforms that rely on onboarding requests or where agent-specific discovery was not found in public material.

What mistakes should you avoid?

Three mistakes recur. Teams treat the inventory as a one-off project and let it go stale within a quarter. They accept a team name as owner, which leaves nobody to answer questions. And they count only agents built in-house, missing the agents that arrive inside SaaS products they already pay for. Each mistake is cheap to avoid at the start and expensive to fix during an audit.

Where to go next

Use the agent onboarding checklist as the registration form. Read the guide on who owns an AI agent before assigning owners. The control pages for GOV-01, GOV-16 and GOV-17 list which platforms document each one, with sources.