A useful agent registry entry answers what an incident responder will ask in the first ten minutes: what is this agent, who owns it, what can it read and do, who does it act as, how do I stop it, and when was it last reviewed. Keep it short enough that people actually fill it in.
Core fields
| Field | Why it matters |
|---|---|
| Name and unique ID | Matches logs to the entry |
| Owner and backup | Someone to call, and someone when the owner leaves |
| Purpose in one sentence | Tells you if it has drifted |
| Environment | Production, staging, personal |
| Autonomy level | Suggest, act with approval, act and report |
Access fields
| Field | Why it matters |
|---|---|
| Identity used | Which account or token the agent acts as |
| Data it can read | Scope and sensitivity |
| Actions it can take | Writes, sends, deletes, payments |
| Tools and connectors | Including MCP servers and third party apps |
| Input channels | What untrusted text can reach it |
Technical fields
| Field | Why it matters |
|---|---|
| Model and version | Needed to assess changes and retirements |
| Hosting and vendor | Where data goes |
| Log location and retention | Where to look |
| Spend and rate caps | Cost control |
Operational fields
| Field | Why it matters |
|---|---|
| Stop procedure | The exact steps and who may run them |
| Rollback notes | What to undo after stopping |
| Last test date and result | Shows currency |
| Last review date and next due | Prevents silent drift |
| Notices and legal basis | For agents that affect people |
Keep it honest
- Make it a source of truth, not a spreadsheet nobody reads. Tie it to access systems, so removing an agent removes its identity.
- Auto fill what you can. Pull connector and token data from your systems and let owners confirm rather than type.
- Flag stale entries. Any entry past its review date turns amber.
- Reconcile. Compare the registry against OAuth grants and connected apps each quarter to find agents that are missing. See employee built agents.
Common gaps
- No backup owner.
- Identity field says "shared service account".
- Input channels left blank because nobody checked.
- No stop procedure, or a stop procedure never tried.
Start small
Begin with eight fields: name, owner, purpose, identity, data, actions, stop procedure, review date. Add the rest as the registry earns trust.
Where Safeguard fits
Safeguard's asset discovery and agent identity cover finding agents and MCP servers and giving each a scoped identity. Our guide on registering MCP servers and agents in the Guard inventory shows one way to do it.
Quick check
What is the minimum viable registry?
Name, owner, purpose, identity, data, actions, stop procedure and review date.
How do I find agents that are not in the registry?
Compare it with OAuth grants, connected app lists and spend on AI services each quarter.
Last reviewed: 19 October 2026.
