An inventory stays accurate only if it is reconciled, not just filled in. Keep one entry per agent with its owner, status, capabilities, depths, certificate and connected systems; update it automatically on every change; and compare it each month against identities, agent platforms and spend. Anything found in those sources but missing from the inventory is an unregistered agent.
What is the inventory, and who owns it?
An AI agent inventory is the authoritative list of every agent acting in your business, from candidates in testing to retired agents kept for the record. The concept is introduced in what is an AI inventory?, and the general question of keeping one is answered in how do you keep an inventory of AI agents? This playbook is about keeping it right over time.
The agent operations lead owns the inventory as a whole. Each entry has an owner: the process owner who sponsors that agent. Security owns the reconciliation against identities. Risk relies on the inventory for classification and reporting, so it should be able to trust it without checking.
Which fields does each entry need?
Identifier and name; sponsor; business process; status (candidate, shadow, live, suspended, retired); identity reference; capabilities with their depths; certificate date and expiry; risk tier; vendor and model provider; data categories; connected systems; approvals; and last review date. The AI agent inventory register template has these as ready columns.
What are the steps?
- Person, agent operations lead: sets the rule that no agent may receive an identity, credentials or production access without an inventory entry.
- Agent, depth 3: creates the entry when a new agent is registered, populating fields from its brief and the approval request.
- Agent, depth 3: updates entries on events. Certification, depth change, new connector, suspension, sponsor change and retirement each update the entry automatically.
- Agent, depth 1: reconciles monthly. It compares the inventory with non-human identities in the access management system, agents on every agent platform in use, model provider accounts, and AI subscriptions in spend data.
- Agent, depth 2: drafts the exceptions report: identities with no entry, live entries with lapsed certificates, entries whose sponsor has left, and fields marked unknown.
- Person, agent operations lead: works each exception, registering, suspending or retiring as needed.
- Person, each sponsor: attests to their entries quarterly, confirming status, capabilities and use.
- Person, risk lead: reviews the inventory as an input to classification and board reporting.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Set the rule | Nothing | none | Making registration a precondition |
| Create entry | Fills fields from brief and request | 3 | Nothing |
| Update on events | Changes entry when something changes | 3 | Nothing |
| Reconcile | Compares with identities, platforms, spend | 1 | Nothing |
| Exceptions | Drafts the exceptions report | 2 | Nothing |
| Resolve | Nothing | none | Register, suspend or retire |
| Attest | Nothing | none | Sponsor confirms each entry |
| Risk review | Nothing | none | Using it for classification |
Which controls keep it accurate, and what evidence do they leave?
Registration before access. The identity team will not create an agent identity without an inventory reference. Evidence: identity records that carry the reference.
Event-driven updates. Changes are written by the systems that make them, not typed in later. Evidence: entry history showing each update and its source event.
Monthly reconciliation. Evidence: the reconciliation report and exceptions list, with how each was resolved.
Sponsor attestation. Evidence: dated attestations per entry.
History kept. Retired agents stay in the inventory with their full history, because past actions may need explaining long after the agent is gone. Evidence: retired entries with their retirement record.
Which signs show the inventory is going wrong?
- Reconciliation finds identities with no entry. Each is an agent nobody registered.
- Live entries with lapsed certificates. Either the agent is acting without current evidence or the entry is stale.
- "Unknown" in key fields. Unknown data categories or connected systems mean nobody checked.
- Sponsors who have left. An agent without a living owner is an agent nobody answers for.
- Entries never change. Agents change all the time; a static inventory is not being maintained.
What should you measure?
Count unregistered agents found per reconciliation, days to resolve each exception, entries with any unknown field, entries overdue for attestation, and live agents with lapsed certificates. The first figure should fall towards none and stay there.
Where does it usually go wrong?
It is a spreadsheet updated by hand. It is correct on the day of the audit and wrong a week later. Connect it to the events that change agents.
It lists agents but not what they may do. A name and an owner tell you little. As an agent inventory tells you what exists, not what it may do argues, the capabilities, depths and bounds must be visible too, or linked from each entry.
Vendor agents are left out. An agent embedded in a third-party product still acts on your data. If it can act, it belongs in the inventory.
Pilots are excluded. Pilots often have the broadest access and the least control. Register them as candidates or shadow agents.
Nobody owns the whole. Each team keeps its own list, and nobody can answer how many agents the firm runs.
Where Pryme fits
In Pryme, each agent's capabilities, depths, certificate dates and verdicts are held on the platform, so entries for Pryme agents update as those change. Agents on other platforms still need to be reconciled from identities and spend. The wider control model is in agent governance is a bound, not a model.
Questions people ask
Should the inventory include agents that only read data?
Yes. A read-only agent can still expose personal data, give wrong answers that staff act on, or later gain write access. Its risk tier may be low, but it should be listed.
How is an agent inventory different from a model inventory?
A model inventory lists models and their validation. An agent inventory lists acting systems, what each may do and who owns it. Several agents can use one model, and one agent can switch models, so you need both and they should cross-reference.
Who can edit inventory entries?
The systems that make changes write to it, and the agent operations lead can correct errors with a recorded reason. Sponsors attest but should not edit their own entries freely.