The AI Agent That Was Never Registered Anywhere

An agent registry is becoming the recommended control, and the guidance concentrates on what to record. Name, owner, purpose, permissions, review date.

‍

A registry contains what somebody entered. The population that matters is the agents running outside it, and finding those requires subtracting the register from what is observed rather than trusting the register.

‍

What Does a Registry Count?

‍

Compliance with a process, which is a different quantity from the number of agents that exist.

‍

An entry appears because a person followed a registration step. So the count measures how many people complied, and an organization reporting forty registered agents has established that forty registrations happened. Nothing in the number speaks to how many were never registered.

‍

Which Makes It a Diligence Metric

‍

Diligence is worth measuring and it is not coverage. Presenting a registry count as an inventory asserts completeness the mechanism cannot produce, and the assertion is the part an auditor will test.

‍

What Does the Reconciliation Produce?

‍

Three results rather than two, and the third is the one nobody discusses.

‍

Registered and observed is the healthy case, where a record exists and activity confirms it. Observed and not registered is the population everybody is looking for. Registered and not observed is the third, and it means the entry describes an agent that has not acted.

‍

Why Does the Third Case Matter?

‍

Because it inflates the coverage figure. An agent decommissioned without anybody updating the record, one that was never deployed at all, and one dormant but still holding credentials all appear as governed. A register full of entries that correspond to nothing looks like better coverage than a shorter accurate one, and retiring an agent properly is where the record should have been closed.

‍

What Makes the Match Possible?

‍

An identifier present on both sides, which is the field most registry templates omit.

‍

A registry records a name, an owner and a purpose. Telemetry records a service principal, a token, an endpoint or a process. Matching one to the other needs a key they share, so unless the entry states which identity the agent runs under, no automated comparison is possible and the reconciliation stays manual permanently.

‍

Which Field Should Be Mandatory?

‍

The runtime identity, captured at registration rather than inferred later. Everything else in a registry describes intent and this one field makes the entry checkable, and an agent whose builder has gone is the case where the identity is the only surviving link.

‍

Where Does the Observed Side Come From?

‍

Four sources, none complete on its own.

‍

• Identity provider records: Non-human principals and service credentials, which establish existence without describing behavior, and which asset discovery treats as a starting population.
• Platform administrative surfaces: Automation platforms hold a definitive list of what was built inside them.
• Host process and connection events: Local execution and egress to model endpoints.

‍

Network egress by destination category completes it. The union of the four is the denominator, and each one alone produces a subtraction scoped to whatever that source can see.

‍

What Does the Subtraction Not Give You?

‍

The true total, and saying so keeps the figure honest.

‍

The observed side has its own coverage limits, so the result is observed minus registered rather than the true population minus registered. What the exercise produces is a floor on the unregistered population, which is more than a registry alone establishes and less than a complete inventory.

‍

Which Is Still the Useful Number

‍

A stated floor with named sources is defensible in a way a registry count is not. An organization able to say it observed sixty-one agents against forty-four registered, from four named sources, has made a claim somebody can check, and getting the unit right in an inventory determines whether those two numbers are even counting the same thing.

‍

What Should Happen to a Finding?

‍

One of three dispositions, recorded, rather than a queue that grows.

‍

Register it, which brings it under governance and requires an owner to accept it. Decommission it, which is the right answer for anything nobody claims. Or accept it with a stated reason and a review date, which is legitimate where a deliberate exception exists. What is not a disposition is leaving it flagged.

‍

What Is the Metric Over Time?

‍

The discovery rate rather than the count. If each reconciliation surfaces roughly the same number of unregistered agents, the registration process is not working and the reconciliation has become a substitute for it rather than a check on it.

‍

Who Should Run the Reconciliation?

‍

Not whoever owns the registry, which is the arrangement that makes the exercise toothless.

‍

A registry owner reconciling their own register is being asked to measure how incomplete their own artifact is. The incentive runs the wrong way, and a low discovery count reads as success rather than as a possible failure of the observed side. Separating the two roles costs nothing and changes what the number means.

‍

Which Function Should Hold Each Side?

‍

The register belongs with whoever operates the governance process, since they own the workflow that populates it. The observed side belongs with security operations, since they own the telemetry and have no stake in the register looking complete. The subtraction is then a comparison between two functions rather than a self-assessment, and the second line challenging the first is the same structural problem in a different setting.

‍

What Should Be Reported?

‍

Both counts and the sources behind each, rather than a single coverage percentage. A percentage hides which side moved, so a figure improving because the register grew looks identical to one improving because a telemetry source stopped reporting.

‍

What Should Be Established?

‍

Three things, and the first blocks the other two until it exists.

‍

Whether the registry records the runtime identity per entry, since without it no automated comparison is possible. Which observed sources are available and what each is authoritative for, because the union is the denominator. Then the current subtraction, meaning observed minus registered, with the sources named. An AI Interaction Data Fabric joins the four observed sources to one identity, which is what makes the comparison a query rather than a project.

‍

Subtract, Do Not Trust

‍

A registry counts compliance with a registration step rather than the number of agents that exist, so presenting the count as an inventory asserts a completeness the mechanism cannot produce. The reconciliation returns three results, and the neglected one is an entry with no observed activity, which inflates coverage because a decommissioned or never-deployed agent still reads as governed. The match depends on an identifier present on both sides, so the runtime identity has to be captured at registration or the comparison stays manual forever. The observed side has its own limits, so the output is a floor on the unregistered population rather than a total, and a stated floor with named sources is defensible where a registry count is not. Kovrr's AI Security and Governance Platform supplies the observed side the subtraction needs.

‍

To see how many agents are observed in your environment against how many are registered, book a demo mapped to your own estate.