Every other control here silently scopes itself to “agents we know about,” so registry coverage is the hard ceiling on governance coverage. The registry is not paperwork; it is the denominator.

The mechanism

An agent nobody can name cannot be tiered, gated, monitored, throttled or revoked. The consequence lands in the metrics: a firm reporting 100% policy compliance across 40 registered agents while holding 200 is reporting 20% compliance. Microsoft lists “no inventory and no ownership” as the first universal governance failure in its own agent guidance, and its product docs now treat an unowned agent as a named risk class, the largest low-code vendor conceding that the population it enabled is the problem.

Inventory keyed on the wrong object misses most of the surface. Snyk’s scan telemetry, behaviour rather than self-report, finds roughly three times as many AI components as declared models, since each model is typically surrounded by two or three tools, datasets, packages and orchestration layers. An inventory answering “which models do we use” has counted a third of what matters. Cloud security has the same boundary: it reports where infrastructure runs and who can reach it, not which agents exist or what they can invoke.

Registration has to be per instance rather than per platform. Instances of the same underlying system get different tools, prompts and permissions and behave differently, so approving Copilot Studio leaves the forty agents inside it uninventoried. Doing this properly needs attestation-style cryptography rather than naming conventions; agent identity is harder than issuing service accounts, and non-human identity covers why.

Two vocabulary traps. “Agent card” now means three incompatible things: documentation attached to an agent identifier in the visibility literature, Google’s A2A AgentCard (a machine-readable capability advertisement for discovery between vendors’ agents), and the WEF/Capgemini governance artifact. Say which one is meant. And Microsoft’s whitepapers use “zone classification” for governance-maturity zoning, which differs from a trust zone.

Fleet-scale central tracking is achievable rather than aspirational: AT&T ran over 3,000 bots in production under a central automation function, though that is 2023-vintage RPA since superseded. The failure mode at scale is subtler, and findability rather than existence is the working test: BMW maintained a central repository of citizen-developed applications and still could not reliably find things in it, because metadata habits vary by builder.

The tooling has moved faster than most write-ups. Microsoft’s tenant-wide Power Platform inventory reached general availability by mid-2026, and a separate Agent 365 registry auto-registers agents at creation with publisher, agent ID, connectors, deployment status and policy state, syncing Salesforce Agentforce and Databricks Genie agents in from May 2026. Anyone still arguing inventory tooling doesn’t exist is working from stale notes. The immaturity is in the details: Microsoft’s own documentation warns that agent counts differ between its admin surfaces, the owner column for flows shows the creator rather than the current owner, and modified-by comes back empty for agents. That is the strongest argument for a cross-platform registry the firm owns itself, and it comes from the vendor’s documentation.

What to do

Awareness comes before gatekeeping, and the first sweep will be incomplete, which the announcement should say out loud. The first pass is a lightweight declaration, deliberately not a review, and the framing that works is amnesty: anyone who built a tool with an AI platform should say so; the exercise is inventory rather than audit.

The dashboards already paid for come next, because verified coverage beats a new procurement. Power Platform inventory and the Agent 365 registry enumerate agents with owner, connectors and policy status today; Salesforce and ServiceNow have their own surfaces.

Record these fields, in this order of value:

• Owner: a named individual, plus a separate business owner where they differ. Team aliases are how agents become orphans while appearing owned.
• Purpose and scope: what it is for, and where its authority stops.
• Tool allowlist and permissions: what it can call and what it can change.
• Secrets binding: which credentials it holds, so revocation has a target.
• Risk tier: an inventory without classification is a list, not a control. See tiering.
• Lifecycle state and review date: active, suspended or retired, and last confirmed when.

BCG’s fuller prescription adds an evaluation suite, a configuration bundle and a runbook with service-level objectives per agent. Treat that as the target state for tier-1 agents rather than the intake form for everything.

Registration needs teeth that stop short of punishment. One firm in the citizen-development case literature gives builders a window to declare what they built and archives the app if they ignore it: reversible, cheap, and it makes non-registration the inconvenient path. Stronger, and this is where the field is heading rather than where it is: bind credentials to registry entries so an unregistered agent cannot authenticate. Research prototypes go further, hashing the agent definition at registration so any prompt or tool change forces re-registration and the hash detects self-modification. That is a design pattern from a vendor-affiliated paper with no deployment evidence: worth knowing, not worth buying.

Fund the sweep. BCG’s version is a platform team with funded authority to sweep the estate, onboard off-platform assets, and hand teams a ranked list of issues with fix steps. A sweep mandate without budget or authority is theatre.

Version identity when behaviour changes. A fine-tuned or materially reconfigured agent is a new identity linked to its parent, not an edit in place; otherwise the incident timeline cannot tell “the agent did this” from “a different agent with the same row did this.”

Under ISO 27001, A.5.9 requires an inventory of assets with owners and A.5.11 covers return of assets on departure. No Annex A control mentions AI or agents, so treating an unregistered agent as a 5.9 exposure is our reading rather than ISO’s, though an auditor will follow it. ISO 42001’s A.4.2 resource documentation is the closer AI-specific hook.

How you’d know it’s working

The discovery delta shrinks. Count how many agents each sweep finds that the registry did not already list; a flat or growing delta means the register-first incentive is failing, whatever the headline count says.

Someone unfamiliar with an agent can find it by searching for what it does. That is the BMW test, and free-text metadata reliably fails it. A registry that needs a person to interpret it is a filing cabinet.

Pick a random registry entry and check three fields against reality. Documentation drifts silently: Chan and colleagues noted that as of April 2024 OpenAI had shipped new GPT-4 versions without updating the GPT-4 system card. Periodic attribute audits are the only known fix; see registry review.

What this doesn’t solve

A registry is a list, not a behavioural control. A fully registered agent can still be injected, over-privileged and wrong; it points at where to look, nothing more. Every page in controls/ is downstream of this one and none is replaced by it.

The registry becomes a targeting map if it leaks. Chan and colleagues are explicit: IDs and ID-linked activity logs let an attacker identify high-value agents and infer which services they touch. It is an asset whose whole purpose is to enumerate the firm’s attack surface, and it needs the access controls a credential store gets.

Self-hosted and personal-account agents stay outside registration, which is most of what shadow agents covers. Identity schemes bind only participants, and the enforcement point that holds is the service edge, not the registry.

Take the owner field, not the employee metaphor, and register agents as assets. Several sources arrive at per-agent ownership through an HR frame: job descriptions, onboarding plans, “digital teammate systems of record.” The accountability requirement is right and the framing is measurably harmful: a randomized experiment with over 1,200 managers found that presenting AI as an employee dropped personal accountability by 9 percentage points and cut error identification.

Finally, the strongest published claim for inventory as the highest-value control comes from a single-author preprint whose numbers are simulation outputs with the answer encoded in the inputs. The case here rests on the tautology at the top of the page and on convergence across the security, workforce and citizen-development literatures, rather than on a measured effect size, because nobody has published one.

See also

• Shadow agents — the unregistered population this shrinks, and why it never reaches 100%.
• Agent sprawl — what the registry counts, and the active fraction that matters more than the total.
• The agent control plane — where the registry stops being a list and starts refusing credentials.
• Logging and audit — registry identifiers are what make a log line attributable to a thing with an owner.
• Registry review cadence — the recurring process without which every field above rots.
• Risk-tier assignment — the consumer of the registry’s fields, and the reason to collect them.
• Offboarding agents and owners — what the owner field is for.