Skip to main content
Before anything can be governed it has to be known. The first question in every examination, every incident review and every security questionnaire is some version of: what have you got running, and who owns it? Most organisations discover two things when they answer it honestly. The list is longer than expected, because “agent” turns out to include scheduled automation that now calls a model. And a meaningful fraction has no owner at all: the person who built it left, the team reorganised, and it has been running quietly since. That second finding is usually worth the exercise on its own.

​
Agents name themselves

Registration is idempotent by name within a workspace, so it is safe on every boot, and an agent appears in the inventory the first time it speaks rather than when somebody remembers to add it. An inventory that depends on a human step is an inventory that is wrong within a month.
owner is a person. Not a mailbox alias, not a team. Everything the agent later does walks back to this, and a distribution list at the end of that walk is the absence of an owner written down.

​
What the inventory holds

  • The agent: name, owner, org unit, autonomy tier
  • Provenance: which model, which version, reported by the SDK rather than typed into a form
  • Tools: the MCP manifest it was seen with, hashed. See Silent change
  • Grants: what it may currently do, and under which enforcement rung
  • Certification: whether it was ever cleared to hold authority at all

​
Autonomy tier

A coarse label, L0 upward, describing how much an agent decides for itself. It is documentation rather than enforcement: the bounds that actually stop things are on the grant. The tier exists so a human scanning an inventory can see which agents deserve a closer look, which is a different job from refusing an action.

​
The gap this closes

Model inventories built by hand describe the deployment somebody remembered. This one describes the deployment that is running, because it is assembled from agents reporting themselves and from decisions already in the ledger.