Keep one register, fed by discovery rather than by memory, with a named owner for every entry. Record each agent's purpose, capabilities and depth, the model it runs on, the systems and credentials it uses, and the agents it talks to. Then enforce the rule that matters: an agent not in the register cannot act, because the enforcement layer will not recognise it.
What is the inventory for?
An AI inventory answers three questions quickly: what agents do we have, who owns each, and what can each touch? Without it, you cannot run an access review, answer a regulator, retire an agent cleanly or work out what an incident affected.
It does not, on its own, tell you what each agent is allowed to do. We make that distinction in an agent inventory tells you what exists, not what it may do. Authority sits in the bounds. The inventory points to them.
What should each entry contain?
| Field | Example | Why |
|---|---|---|
| Name and identifier | Billing assistant, AG-014 | Unique reference across systems |
| Owner | Head of customer billing | Who answers for it |
| Purpose | Explain bills, set up payment plans | Scope in one line |
| Capabilities and depth | Explain: 3; payment plans: 2 | What it does and how far |
| Certificate dates | Issued and lapse dates | Shows whether evidence is current |
| Model and version | Provider and version reference | Changes trigger retesting |
| Systems and credentials | Billing system read; plans write | Feeds access reviews |
| Links to other agents | Hands disputes to AG-021 | Shows chains and separation of duties |
| Status | Candidate, live, suspended, retired | Lifecycle |
| Supplier | Built in-house or vendor name kept in procurement records | Third-party management |
A ready-to-copy layout is in the AI agent inventory register template.
The links field is often missed. Two agents that each look harmless can together prepare and approve the same action. Recording which agents hand work to which makes it possible to check separation of duties between AI agents.
What are the steps, and who acts?
- Governance lead: sets up the register and the rule that only registered agents can act. Evidence: the policy and the register.
- Security: runs discovery. Look for service identities calling model providers, software licences that include agent features, and expense claims for model subscriptions. Evidence: discovery reports.
- Governance lead: registers what discovery finds and assigns an owner. Agents without an owner are suspended. Evidence: the register entries and suspension records.
- Owners: keep their entries current. Every change to capabilities, depth, model or systems goes through change control, which updates the register. Evidence: change records linked to entries.
- Platform: refuses unregistered agents. The enforcement layer checks every action's agent identity against the register. Evidence: refused verdicts for unknown identities.
- Governance lead: reconciles quarterly. Compare the register with discovery, access systems and the record of verdicts. Evidence: the reconciliation.
Our playbook on maintaining an inventory of AI agents covers the routine in more depth.
A worked example
Take a regional bank that believes it has six agents. Discovery finds eleven. Three are features switched on inside software the bank already licensed; one is a marketing team's agent writing social posts through a personal account; one is a retired pilot whose service identity still has read access to the customer database.
The bank registers the three software agents with owners, stops the marketing agent until it is rebuilt under policy, and removes the retired pilot's identity. It then connects its enforcement layer to the register, so a twelfth agent appearing next month will be refused on its first action and discovered that way.
Which controls keep the inventory true?
- Discovery, not self-reporting.
- No owner, no agent.
- Register updates through change control, not manual edits.
- Enforcement tied to the register, so unregistered agents cannot act.
- Quarterly reconciliation against access and activity.
The topic guide, agent governance is a bound, not a model, explains how the register supports the bounds.
Questions people ask
Does the inventory need to include agents inside vendor software?
Yes. They act on your data and systems. Register them with an internal owner, even if the vendor runs them.
What about staff using general-purpose assistants?
Usage that only drafts text for a person may sit under your acceptable use policy rather than the register. Anything that connects to company systems or acts belongs in the register.
How does the inventory relate to EU AI Act obligations?
The register helps you identify which systems might be high-risk and which obligations apply as provider or deployer. It is a starting point for that assessment, not the assessment itself.