top of page

Agent Inventory Card

S. West
2 hours ago
5 min read

The triage agent closed three hundred tickets on a Friday afternoon, and nobody could say who owned it.

A support lead enabled the service desk's new agent feature under her own OAuth token. Later a colleague added a chat connector. When it marked every open ticket a duplicate and messaged each customer, revoking the token would also have broken the nightly asset sync. The register said "ticket summaries, advisory".

(Composite example, assembled from patterns common in enterprise agent rollouts. The figures are illustrative.)

A register records intent. This worksheet starts from the other end: what each agent may do today, which credential grants it, and how fast you can stop it.

Step 1: count the doors

Name who could count, today, last quarter's arrivals through each door.

Door

How an agent arrives

Named person

Count

Engineering-built

A team builds on an LLM API and ships through the pipeline

______

___

Vendor-embedded

A SaaS feature an admin enables, or an update turns on

______

___

Builder-made

A low-code builder wired to an existing integration account

______

___

Developer tooling

Coding agents on laptops, reaching repos and consoles through MCP servers

______

___

  • ☐ Every door has a name. A nameless door is outside your policy.

  • ☐ Newest three register entries record their credential? 1: Y / N, 2: Y / N, 3: Y / N.

Step 2: find where authority changes without a release

OWASP LLM06:2025 calls this Excessive Agency and names three root causes: excessive functionality, excessive permissions and excessive autonomy.

Authority lives in

Changes with no release when

OWASP root cause

Card field

Tool grants

A connector or MCP server is added

Excessive functionality

6, 8

Credentials

It borrows a service account or a person's token

Excessive permissions

5

Autonomy settings

A toggle moves it from suggest to apply

Excessive autonomy

9, 11

Each change looks reasonable alone; together they build a blast radius nobody approved.

Step 3: fill in one card per agent

Write unknown, never a blank, where nobody can answer.

#

Field

What to record

Composite example

Your value

1

Agent ID

ID and short name

AGT-0212, ticket-triage

______

2

Entry door

One of the four

Vendor-embedded

______

3

Accountable owner

Named person who can switch it off

unknown

______

4

Technical owner

Named engineer or team

Service desk admins

______

5

Identity

Credential; dedicated or shared, and who else uses it

Shared personal token, also used by asset sync

______

6

Tools / connectors

Each system and access level

Tickets (read/write), chat (send)

______

7

Data touched

Data classes

Customer contact details

______

8

Unattended actions

What it does with no human

Close tickets, message customers

______

9

Approval gate

Exists? On or off?

Exists, off

______

10

Reversibility

Per action: easy, manual compensation, irreversible

Close: manual. Message: irreversible

______

11

Authority tier

0 to 3 (Step 5)

2

______

12

Kill switch

Control, tested?, identity revocation safe?

Feature toggle, not tested; revocation unsafe

______

13

Logs

Location, who can reach them, retention

Vendor console, unknown

______

14

Last reviewed

Date and trigger

At enablement

______

Unknown count: ____ / 14. The bold fields would have changed that Friday.

Step 4: run the 15-minute test

Pick five agents across the doors; include a vendor-embedded one and an MCP user. Answer from a record, not by asking around.

  1. Who owns it accountably?

  2. What can it change, including send, pay or publish?

  3. What stops it, and what breaks alongside?

  4. What has it done since yesterday, per the logs?

Agent

Door

Q1

Q2

Q3

Q4

All four in 15 min?

1

______

☐

☐

☐

☐

Pass / Fail

2

______

☐

☐

☐

☐

Pass / Fail

3

______

☐

☐

☐

☐

Pass / Fail

4

______

☐

☐

☐

☐

Pass / Fail

5

______

☐

☐

☐

☐

Pass / Fail

Score: ____ of 5. 0 to 2: start the Step 6 sweep this week. 3 to 4: card the failures. 5: check every door, then tier.

The 15-minute limit and score bands are ShiftQuality's recommendation, not an external standard.

Step 5: tier by unattended authority

Tier

Authority

Minimum controls

0

Reads internal data only

A card and an owner

1

Easily reversed writes (drafts, tags)

Plus dedicated identity, logs kept

2

Visible or compensable actions (customer messages)

Plus approval gate or rate limit, tested kill switch

3

Irreversible actions, restricted data, regulated decisions

Plus a person approves each action or batch, a drill each quarter, legal sets retention

Tiers and minimum controls are ShiftQuality's recommendation, not an external standard.

Drill each agent at Tier 2 or above:

  • ☐ Stop it with the recorded kill switch in a booked window: ____ minutes.

  • ☐ Record what else broke, then update fields 5 and 12.

Step 6: sweep credentials in week 1

Trace back from what can act.

  • ☐ Identity provider: export OAuth grants and app registrations, filter for write, send and offline scopes, and list service accounts active within 12 months.

  • ☐ Secrets manager: list LLM provider keys and keys for systems agents call.

  • ☐ Repositories: find committed MCP configs with git ls-files | grep -E '(^|/)(\.mcp|\.cursor/mcp|\.vscode/mcp)\.json$', then search for the server keys with git grep -lE '"mcpServers"|"mcp"[[:space:]]*:' (VS Code uses a "servers" key, so also review any .vscode/settings.json hits).

  • ☐ Endpoints: query user-level MCP configs on laptops.

  • ☐ SaaS consoles: list enabled agent features and custom agents.

Week 2: card each holder an agent uses. Week 3: tier and drill. Week 4: enforce "no card, no Tier 1+ credential" in the identity provider, reopen tiering on any tool, identity or autonomy change, and add an "agent features enabled?" check to renewals.

How to use it

  • Who: an engineering leader with identity and platform owners. Start at Step 4.

  • Output: door counts, cards, a test score, tiers and a sweep list.

  • Done when: agents at Tier 2 or above each have a full card, their own identity and a kill switch someone has pulled, and the identity provider refuses uncarded credentials.

Where this changes

Small teams can card coding agents and read-only assistants by class, with approved MCP servers and no production credentials on laptops. Opaque vendor agents still get a card listing the gaps. Regulated teams should split Tier 3 shared identities first and confirm log access: for high-risk systems in the EU, AI Act Art. 26(6) requires deployers to keep the logs under their control for at least six months, unless other law sets a different period. For Annex III systems that obligation applies from 2 December 2027 (as amended by Regulation (EU) 2026/1744).

Final takeaway

This week, test five agents and ask your identity owner for every write-scoped grant and service account used in the last 90 days, a fast first cut of the 12-month sweep in Step 6. Governance reaches only the agents on your list.

Sources

bottom of page