AI agent inventory. What to track, and where to look.
You cannot scope what you cannot list, and the first list is always incomplete. That is not a reason to delay it: an incomplete inventory with honest gaps beats a complete one that was never finished.
cursor-agentOwner: platform lead · prod roleCustomer data- Agents leave traces in four places: OAuth consent logs, MCP configuration files, CI workflows and model provider key usage.
- Track eight fields, and the one most inventories skip is the one that matters: what the agent can reach.
- An entry you cannot fill is a result, not a blank. An agent with no owner is the definition of a shadow agent.
- The inventory is never finished. New agents appear weekly, so build it as a recurring query rather than a spreadsheet.
Published Last reviewed
Four places agents leave traces.
Each one is a list somebody in your organisation can export today. None of them is complete on its own.
In Google Workspace, third-party app access and the OAuth token audit log. In Microsoft Entra ID, enterprise applications, user consents and the audit event for consenting to an application. This is where employee-installed AI tools appear, and it is usually the biggest single source.
Local configuration the clients read, plus repository and CI files that start servers. The tokens in these files are frequently in plain text, which means this source gives you the agent and its credential in one step.
Workflow files that call AI CLIs, and the secrets those steps receive. A review step that only needs read access but gets a deploy token is both an inventory entry and a finding.
Keys that suddenly call from a new client, a notebook host or an AI SDK. Billing is an underrated source here: a model provider invoice lists usage nobody registered.
Eight fields worth tracking.
The seventh is the one that turns an inventory into a priority list. The others describe the agent, that one describes the risk.
| Field | Why it is on the list | Where it usually comes from |
|---|---|---|
| Name and type | So two entries are not the same agent. | The source system |
| Owner | Without it nothing can be reviewed or revoked. | Has to be assigned by a person |
| Identity it runs as | The join key to everything else. | Cloud IAM, directory, config file |
| Credentials held | What would need rotating after an incident. | Config files, CI secrets, vault |
| Direct permissions | The part every review already covers. | IAM, OAuth scopes |
| Assumable roles | Usually wider than the direct permissions. | Cloud IAM role trust |
| What it can reach | The field that ranks the list. | Derived, not read |
| Last used | Separates live agents from forgotten ones. | Audit and access logs |
How to build it. Four steps.
In this order, because step one is where most inventories stall.
OAuth consents usually give the most entries for the least effort. Finish that source before opening the next one, otherwise nothing gets completed.
Work down the list by what each agent can get to. The ones that touch production get an owner this week, the rest can wait.
An agent with an unknown owner belongs in the inventory with the owner field empty. Leaving it out to keep the list clean is how shadow agents stay invisible.
A spreadsheet is accurate on the day it was written. Rebuild the inventory from its sources on a schedule, and compare runs rather than editing cells.
Questions, answered.
Short answers on ai agent inventory.
What should an AI agent inventory contain?
At minimum: the agent, its owner, the identity it runs as, the credentials it holds, its direct permissions, the roles it can assume, what it can reach and when it was last used. The reach field is the one that lets you rank the list, and it is derived rather than read from any single system.
How do I find AI agents nobody registered?
Follow credentials rather than software. OAuth consent logs, MCP configuration files, CI workflows that pass secrets to AI CLIs, and model provider keys appearing from new clients. Each is a list somebody can export today, and the first pass is always incomplete.
How often should the inventory be rebuilt?
Often enough that the gap between runs is shorter than the time it takes a new agent to get production access. In most teams that is weekly. The comparison between two runs is more useful than either run on its own.
Keep reading.
The pages that belong to the same picture.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.