Run an Internal Agent Registry Before It Hurts

An internal agent registry is the single artifact that turns “how many AI agents do we run?” from a guess into a query. It is not a platform purchase and not a governance programme. It is a table with eight columns — owner, scope, data touched, credentials held, model and version, kill path, last reviewed, next review due — and a standing 30-minute appointment once a quarter to keep it true.

The reason to build it now is that the counting problem has already escaped most organisations. Agents get stood up inside a workflow tool by a marketing manager, inside a repo by an engineer, inside a CRM by an admin who found the toggle. Each one holds credentials. Each one can act. And the surveys that try to measure the resulting fleet keep finding the same shape: adoption running well ahead of anybody’s ability to enumerate, let alone supervise, what has been deployed.

This guide is deliberately narrow. It gives you the column schema, a mapping from those plain-English columns to the field names in the Cloud Security Alliance’s draft registry spec, a timeboxed quarterly ritual, and an honest read of where the EU AI Act clock actually sits after the Digital Omnibus. For the enforcement machinery itself — who fines whom, under which article — see the enforcement and penalties guide. This post is the inventory, not the rulebook.

Ask a mid-size company how many AI agents it operates and you will usually get a confident answer that is wrong in one direction: too low, because the answer counts the agents that went through procurement and misses the ones that were configured inside tools already paid for. That is the same failure mode shadow IT produced a decade ago, with a meaningful difference — shadow spreadsheets did not hold OAuth scopes or write to production systems.

The best public measurement of the gap comes from Gravitee’s State of AI Agent Security 2026 report, published February 4, 2026. It is a single vendor-run survey rather than a triangulated data set, so read the percentages as one report’s picture rather than settled fact. The shape it describes is nevertheless consistent: coverage and control lag deployment badly, while executive confidence runs ahead of both.

Read the last two bars together and you have the entire argument for a registry. Eighty-two percent of executives believe their existing policies protect against unauthorised agent actions, in a sample where 47.1% of agents are actively monitored. The two figures count different things — executives in one case, agents in the other — so they do not subtract into a single spread. Read side by side, they still describe confidence running ahead of coverage, and that is not a policy problem. It is an inventory problem. Policy applies to things you have enumerated.

The forward pressure is the part worth planning around. Gartner research presented in April 2026 projects that the average global Fortune 500 enterprise will run more than 150,000 agents in production by 2028, up from fewer than 15 in 2025 — roughly four orders of magnitude in three years. Treat the specific figures as directional rather than precise; the operational point survives either way. A manual count that works at fifteen agents does not degrade gracefully. It stops working entirely, and it stops working without announcing itself.

Every column below exists because a specific failure happens without it. That is the test we apply when teams ask whether to add a ninth: name the incident the column prevents, or leave it out. A registry with eight columns that are all filled in beats a registry with twenty columns that are half empty, because half-empty rows train people to stop trusting the file.

The worked examples use an invented organisation at example.com. Fill your own version in a spreadsheet first. Migrate to a real system only when the spreadsheet is demonstrably too small — which, for most teams, is later than vendors would like.

Two columns carry more weight than the rest. Owner is the one that decides whether the file is a living document or an archive: a team alias in that cell means nobody is accountable, and in practice nobody reviews. Credentials held is the one that decides whether an incident is survivable, and it is the column most teams fill in last. If you need the deeper treatment of how agent credentials should be scoped and issued in the first place, see the non-human identity playbook — the registry records the decision, it does not make it for you.

The Cloud Security Alliance published a draft Agent Registry Specification v1 on March 27, 2026, defining a schema for agent-profile records. It is more elaborate than what a small team needs on day one — identifiers expressed as SPIFFE URIs, explicit permission boundaries, behavioural fingerprints — but it is the clearest public statement of where registry schemas are heading.

Rather than inventing columns from nothing, we mapped ours onto it. Start with the left-hand column in a spreadsheet. When you outgrow that, you are not migrating to a new idea, only to a machine-readable expression of the same one.

Most published governance guidance is program-shaped: establish policies, define lifecycle, monitor and remediate, train employees. All sensible, all unrunnable for a team of nine people with no governance function. The compression below takes the inventory and lifecycle pieces of that advice and turns them into a single recurring appointment with a hard time budget.

The time budget matters more than it looks. A review with no ceiling becomes a meeting, a meeting becomes a project, and a project gets deferred. Thirty minutes fits in the gaps of a normal week, which is the only reason it survives to the second quarter.

The eight minutes on kill paths are the ones people try to cut, and they are the ones that find real defects. Testing two agents per quarter is not thorough coverage; it is a sampling method. If both samples pass four quarters running, your runbooks are probably accurate. If the first sample fails, you have learned something no amount of documentation review would have surfaced. The sign-off line at the end is what makes the whole thing auditable later — pair it with proper audit-trail design for agents so the registry and the runtime log tell the same story.

This is where most agent-governance writing goes wrong, so it is worth being precise. On August 2, 2026 the EU AI Office’s enforcement powers over general-purpose AI providers became exercisable, penalties for prohibited practices under Article 5 became exercisable, and the Article 50 transparency obligations took effect. Those are live obligations for in-scope deployments today.

What did not take effect on that date is the tier most compliance plans were built around. The Digital Omnibus on AI — Regulation (EU) 2026/1744, in force since July 27, 2026 — deferred stand-alone high-risk obligations under Annex III to December 2, 2027, and embedded-product obligations under Annex I to August 2, 2028. Any summary telling you that high-risk duties became enforceable in August 2026 is describing a timeline that was changed a week before it arrived.

Two consequences follow, and they pull in opposite directions. The first: if you were racing a high-risk deadline, you have roughly sixteen more months than you thought. The second, and the reason this section exists in a registry post: Article 50 transparency applies now, and you cannot disclose what you have not enumerated. Knowing which of your agents generate synthetic content or interact directly with people is a precondition of complying with a duty that is already in force, not a preparation for one that is coming.

Here is the planning arithmetic worth writing on a whiteboard. December 2, 2027 is about sixteen months from this post. A quarterly registry review gives you five sittings before that date arrives: November 2026, February 2027, May 2027, August 2027 and November 2027. At thirty minutes each that is two and a half hours of standing effort in total. If your organisation ends up with Annex III systems in scope, five reviews of accumulated, dated, owner-attributed inventory is a materially different starting position than a scramble that begins in late 2027 — and the oversight expectations that come with regulated deployments are covered in the regulated-industries oversight patterns.

You do not need a regulator to justify a registry, because the two most widely referenced AI governance frameworks both start in the same place. The NIST AI Risk Management Framework, published in January 2023, carries an explicit inventory subcategory under its GOVERN function. It is one sentence, and it is the whole brief.

Note the second clause. NIST does not ask for a complete inventory of everything at equal depth; it asks that the mechanism be resourced according to risk priority. That is permission to keep a thin row for a low-risk internal summariser and a thick one for an agent with write access to customer records — which is exactly how small teams should use the eight columns.

We are deliberately not quoting a clause number for the ISO 42001 inventory requirement. Public excerpts of the standard do not make the precise citation verifiable without the paid text, and an invented clause reference is worse than none — if you are pursuing certification, your auditor will point you at the exact wording. The broader policy layer that sits above the registry, including approval gates and access reviews, is covered separately in the agent governance framework.

A registry does not usually fail loudly. It fails by staying plausible while ceasing to be true, which is worse than not having one — an inaccurate inventory produces false confidence in exactly the group that would otherwise be nervous enough to check.

The third mode is the one that will get harder rather than easier. Every serious agent framework now ships some form of delegation, so the share of agents capable of spawning others is more likely to rise than fall. That points at a structural conclusion: a registry built purely as a manual document has a shelf life. The plain-English version is right for the first year, and the reason to name columns after the emerging schema conventions is that the second year will want them generated from your identity provider rather than typed by a person.

Four common starting positions, and the honest first move for each. None of them begins with buying software.

If you want a broader diagnostic before committing to a cadence, the 100-point agent-stack readiness checklist covers the one-time audit that sits upstream of this; the registry is what keeps its findings true six months later. And if the honest answer to “who owns this?” is nobody, that is the actual first task — our AI and digital transformation engagements typically open with exactly this inventory-and-ownership pass, because every later decision depends on it.