What should an AI agent inventory record?
Eight things per agent: a stable identity, the role it holds, the organization that owns it, the human accountable for it, the credentials and scopes it uses, the loops or schedules that wake it, its current state, and who has authority to stop it.
Most organizations cannot produce this list at all. IBM Institute for Business Value reported that 18% maintain a current and complete AI inventory (IBM, Think 2026, 11 May 2026). The rest have fragments: a vendor console here, a key vault there, a spreadsheet someone last touched in spring.
The eight fields
| # | Field | The question it answers | Where the truth usually lives |
|---|---|---|---|
| 1 | Identity | Which agent is this, exactly? | The platform that runs it |
| 2 | Role | What is it responsible for? | Its definition (prompt, tools, boundaries) |
| 3 | Owning organization | Whose asset is it? | Too often: a person's account |
| 4 | Accountable human | Who answers for it today? | Nobody's, after a departure |
| 5 | Credentials and scopes | What can it touch? | A key vault, unlinked to the agent |
| 6 | Loops and schedules | What wakes it up? | Cron entries, loop definitions |
| 7 | State | Is it running, idle, stopped? | The runtime |
| 8 | Stop authority | Who may shut it down? | Usually unwritten |
If a field is missing, the inventory can list an agent but cannot answer the question someone will actually ask. "Can we turn this off?" needs fields 6, 7 and 8. "Who approved this?" needs 3 and 4. "What did the leaked key expose?" needs 5.
Registry versus inventory
A registry tells you what exists and how to reach it. An inventory also tells you who owns it, what it may do and who can stop it.
Rendering diagram…
Why hand-kept inventories die
A spreadsheet goes stale because nothing forces it to change when an agent is created. The inventory that stays true is the one read from the system that runs the agents. Build the list from sources that change when reality changes: the runtime's agent list, the key listing, the loop list. Then add the fields no system knows, like the accountable human.
Two reads that belong in any agent inventory script, both served by agent.ceo's API:
# The organization's agents, read with a key scoped to reading agents
curl -s "https://api.agent.ceo/api/v1/customers/$ORG/agents" -H "X-API-Key: $READ_AGENTS_KEY"
# The organization's defined loops: what wakes agents up
curl -s "https://api.agent.ceo/api/v1/orgs/$ORG/loops" -H "X-API-Key: $ORG_API_KEY"
In agent.ceo, an agent is created inside an organization as a role, so fields 2 and 3 exist from the moment the agent does. The organization's registry lists its registered agents, and organization API keys are listed by name and scope without their secret values.
FAQ
What should an AI agent inventory record?
For every agent: a stable identity, the role it holds, the organization that owns it, the human accountable for it, the credentials and scopes it uses, the loops or schedules that wake it, its current state, and who has authority to stop it. If any of those is missing, the inventory can list an agent but cannot answer the question someone will actually ask about it.
Why do hand-maintained AI agent inventories go stale?
Because agents are created faster than anyone updates a spreadsheet, and nothing forces the update. An inventory stays true when it is read from the system that runs the agents, not written separately by a person after the fact. IBM Institute for Business Value reported in May 2026 that 18% of organizations maintain a current and complete AI inventory.
What is the difference between an AI agent inventory and an agent registry?
A registry answers what exists and how to reach it. An inventory also answers who owns it, what it may do and who can shut it down. A registry is a necessary part of an inventory, not a substitute for one.
Related: Who owns this AI agent? Why a registry isn't enough · Agent governance and inventory