AI agent inventory: the register regulators will ask for

Inventory agents, not models

A model is a capability. An agent is a thing that acts: it has an identity, a purpose, a set of tools it can call, data it can reach, and someone accountable for it. Three agents built on the same model can carry entirely different risk.

Registers organised by model answer "what AI do we license". Registers organised by agent answer "what is running against our systems, on whose authority, and who is responsible" — which is the question every framework and every auditor is actually asking.

Fields that earn their place

A register nobody maintains is worse than none, because it produces false assurance. Keep it to fields that change behaviour:

• Identity — a stable identifier the agent presents when it acts.
• Stated purpose — what it is for, in a sentence, in plain language.
• Owner — a named person, not a team mailbox.
• Risk tier — drives which actions need oversight.
• Environment — development, staging or production.
• Declared tools and data sources — the scope it is permitted to operate within.
• Lifecycle state — draft, pending, active, suspended, retired.

Why the declared scope is the most useful field

Purpose and owner are documentation. A declared tool list is enforceable: once an agent states which tools it uses, any action outside that list is detectable automatically, without anyone writing a rule for it.

This turns the register from a compliance artefact into a live control. It is also the field most often left empty, because it is the one that requires the team to actually think about what the agent should be allowed to do.

Keeping it accurate

Registers rot. The defences are to make registration a prerequisite for access rather than a parallel process, to default new entries to a pending state that must be explicitly activated, and to reconcile the register against observed activity continuously so drift surfaces as a finding rather than accumulating silently.