What an AI Agent Registry Should Record

Seven fields carry an agent registry, and they split into two kinds. Some a person has to state, because the answer exists only in somebody's intention. The rest can be read from systems that already hold them.

‍

Which kind each field belongs to decides whether the registry drifts. Typing an observable value creates a record that was accurate on the day somebody typed it, and recording a declared value is the only way to capture it at all.

‍

The Field Most Registries Omit

‍

Runtime identity, meaning the account or service principal the agent authenticates as.

‍

Why It Matters More Than the Others

‍

Every downstream record is keyed to an identity. Without this field, an agent's activity in a gateway log, a directory record or a network trace cannot be connected back to the registry entry, so the registry describes something nobody can find.

‍

What Breaks Without It

‍

Reconciliation. There is no way to ask which registered agents have been active this month, or which active identities correspond to no registered agent. An agent nobody registered is invisible precisely because that comparison cannot be run.

‍

Which Fields Does a Person Have to State?

‍

Three, and they share the property of existing only as intention until somebody writes them down.

‍

Business Owner

‍

The person accountable for the agent continuing to run. Absent it, an incident escalates to whoever is nearest rather than to whoever can authorize stopping it, and the decision takes hours it did not need to take.

‍

Technical Owner

‍

The person who can explain how it works and change it. The two roles are frequently different people, and a registry carrying only one of them produces either an owner who cannot act or an engineer who cannot decide.

‍

Stated Purpose

‍

What the agent was approved to do, in a sentence. Absent it, no later comparison against observed behavior is possible, because there is nothing to compare against. Capturing it costs one field at approval and cannot be reconstructed afterward.

‍

Which Fields Should Be Read Rather Than Typed?

‍

Three, and typing them is the most common cause of a registry nobody trusts.

‍

Permissions

‍

What the agent's identity can reach, which the directory already knows. A typed permission list describes the grant at the moment of writing, and grants widen quietly.

‍

Tool Access

‍

Which tools and servers it can invoke. Gateway records hold this, and in an environment where tool servers start on demand the typed version is wrong within a sprint.

‍

Data Reach

‍

Which categories of regulated or commercial material sit inside the systems those permissions open. Derivable from the permission set rather than assessed separately, which also keeps the two consistent with each other.

‍

How Does a Registry Stay Current?

‍

Through three mechanisms, none of which is a reminder to update a spreadsheet.

‍

• Discovery: Finding identities and agents that exist and appear in no registry entry.
• Reconciliation: Comparing registered agents against observed activity, in both directions.
• Attribute refresh: Re-reading the observable fields from their source rather than asking anybody to confirm them.

‍

What Each Catches

‍

Discovery catches the unregistered. Reconciliation catches the registered-but-dormant, which is how an agent nobody retired stays on the books. Attribute refresh catches the widened grant, which is the change most likely to matter and least likely to be reported.

‍

What the Review Date Is For

‍

Re-confirming the declared fields only. Observable fields never go stale where they are read, so a review that re-checks permissions is spending attention on the half that maintains itself.

‍

What Else Belongs on the Record?

‍

Two fields that are neither declared nor observed in the ordinary sense, and both earn their place.

‍

Lifecycle State

‍

Whether the agent is in development, production or retired. Without it a decommissioned agent stays indistinguishable from a live one, and its credentials usually outlive it. Sprawl accumulates at the retirement end rather than the creation end.

‍

Autonomy Level

‍

Whether a person approves actions before they execute. The field changes how every other entry should be read, since the same permission set carries different exposure depending on whether something stands between the agent and the action.

‍

What Does the Registry Feed?

‍

Two things, and neither works on a registry that drifts.

‍

Identity Management

‍

Agents need credentials issued, rotated and revoked like any other principal, and the registry is what says which identities are agents at all. Managing agent identity at scale depends on that list being complete.

‍

Risk Assessment

‍

Permissions, tool access and data reach are the severity inputs for any exposure figure, so a registry holding them accurately is also the input to quantification. An AI risk register then carries the scenarios those fields imply, and agent governance enforces against the same record.

‍

What Should Be Established?

‍

Three things, and the first takes one query.

‍

Whether every registry entry carries a runtime identity, since without it no entry can be reconciled against anything. Which fields are typed that could be read, because those are the ones drifting right now. Then whether anything compares the registry against observed activity in both directions, as the registered-but-dormant and the active-but-unregistered are different problems with different owners.

‍

Record What Only People Know, Read the Rest

‍

Seven fields carry an agent registry and they divide by origin. Business owner, technical owner and stated purpose exist only as intention until somebody writes them down, and none can be reconstructed later. Permissions, tool access and data reach are already held by directories and gateways, so typing them produces a record that was true on the day it was typed. Runtime identity is the field most registries omit and the one every other record is keyed to, without which reconciliation is impossible in either direction. Lifecycle state and autonomy level complete the set, the first because decommissioned agents keep their credentials and the second because the same permissions carry different exposure depending on what stands between the agent and the action.

‍

To see an agent inventory that reads its observable fields rather than storing them, book a demo mapped to your own estate.