Start with inventory unless you already know every agent, model and tool server you run. You cannot enforce a policy on something you have not found. If you do have a reliable list, start with enforcement on the highest risk actions and let inventory catch up.
The two starting points
Inventory first means discovering what exists: agents, models, MCP servers, the identities they use and the data they reach. The output is a list with owners.
Enforcement first means setting rules and blocking or requiring approval when they are broken: a gate on a pull request, a limit on which tools an agent may call, a required review for a new server.
Both are needed. The question is sequence, and the answer depends on what you already know.
A decision table
| Your situation | Start with | Why |
|---|---|---|
| Developers installed AI tools freely, no list exists | Inventory | Unknown items cannot be governed |
| You have a list but no rules | Enforcement on top risks | Visibility already exists |
| A regulator or customer asks what you run | Inventory plus evidence | You need the list to answer |
| One agent already touches production data | Enforcement on that agent now, inventory in parallel | Reduce exposure first |
| A small team with three known agents | Enforcement | The list fits on a page |
If you are unsure, assume you are in the first row. Most organizations find more than they expected.
What inventory should capture
Keep it modest at first. For each item record the name, owner, where it runs, which identity it uses, what it can reach, and when it was last reviewed. Our agent registry entry fields post lists the fields in more detail.
Include shadow items. The MCP ecosystem makes it easy for a developer to add a server in a minute, so check developer machines and shared configs, not only source control.
What enforcement should start with
Do not try to write the perfect policy. Begin with three rules.
- New agents and tool servers need a named owner and an approval.
- Agents get the least access that lets the task work.
- Changes to a tool's description or scope after approval trigger review.
The MCP specification supports the spirit of these: human ability to deny tool calls, access controls on servers, and treating tool annotations as untrusted unless the server is trusted.
Try it yourself
Open the pull request gate demo and notice how a rule decides whether a change proceeds. Consider which agent related rule you would put at the same point.
Click through it at your own pace, or open it full screen.
Buying implication
Ask each vendor which half they do natively and which they expect you to supply. A tool strong at inventory but weak at enforcement may still be the right first purchase if you are in row one of the table. Revisit after ninety days.
Safeguard offers asset discovery for inventory and policies, gates and guardrails for enforcement, with agent identity and MCP Guardrail for agent specific cases. Autonomous remediation with fix pull requests is off by default, and every category starts on Manual.
Quick check
Can we do both at once?
Yes, with different owners. Keep enforcement narrow while inventory expands, so you do not block work on guesses.
How do we know inventory is complete?
You do not, so measure drift. Track how many items are found each month that nobody registered.
Sources
Last reviewed: 19 October 2026.
