Agent Registry
A central inventory of every AI agent authorized to act on an organization's systems — the source of truth that turns 'we have no idea what's running' into 'we have a list.' Each entry records the agent's owner, purpose, the systems and data it touches, the identity it authenticates with, its risk tier, and a kill switch. The operating rule is simple: if it's not in the registry, it's not allowed to run. A registry is the primary antidote to Agent Sprawl and shadow agents, and it's the artifact auditors actually want when they ask you to enumerate systems that touch regulated data. Discovery feeds the registry; governance flows from it.
Written by Max Zeshut
Founder at Agentmelt · Last updated Sep 9, 2026
Example
A registry entry for a sanctioned support agent: owner = Support Ops lead; purpose = draft + send tier-1 replies from the help desk; systems = Zendesk (write), knowledge base (read); identity = scoped service principal, 1-hour tokens; data class = customer PII; risk tier = medium; kill switch = disable the service account in Okta.
Frequently asked questions
- Do we need special software for an agent registry?
- No — start with a spreadsheet. The value is in the discipline (every agent enumerated, owned, and re-attested), not the tooling. As the count grows, teams graduate to a CMDB entry, a governance platform, or an identity-provider-backed inventory, but a maintained spreadsheet beats an unmaintained platform every time.