Let’s talk about the inventory nobody can produce.
Picture a company. Nothing exotic — insurance, freight, a regional bank. Over the last eighteen months it did the sensible thing and let teams build agents. Marketing has one that drafts campaigns. Operations has one that reads invoices. IT stood one up against the service desk. And somewhere in a sandbox is an agent a contractor left behind, still holding a token, still able to reach a folder nobody remembers sharing.
Now ask that company how many agents it is running.
Not pilots. Agents.
They can’t tell you. Not because they’re careless. Because nobody in the building holds a complete list.
IBM’s Institute for Business Value puts it flatly: fewer than one in five organisations maintain a complete, current inventory of their AI systems, and less than half have visibility into what agents exist across their environments. OutSystems surveyed 1,900 IT leaders this year — 96 percent run agents, roughly 12 percent have a centralised way to manage them.
That is not a tooling gap. That is a company that has handed authority to software it cannot name.
So of course the fix showed up as a market.
On 24 September, Dataiku launched Agent Management — a standalone product that scans AWS Bedrock, Databricks, Google Vertex, Microsoft Copilot Studio, Azure Foundry, Salesforce Agentforce, Snowflake Cortex and Dataiku itself into one inventory, with OpenTelemetry for everything custom. It finds the agents, records who owns them, what they can reach, what they were approved to do, and flags the ones it doesn’t trust.
Read that as helpful and it is helpful. Read it as a pattern and look at the fourteen days before it.
Between 24 August and early September, four vendors shipped standalone agent governance products. Okta came from identity with Agent SSO. IBM came from orchestration with an AgentOps agent inside watsonx Orchestrate. Broadcom came from security with AgentMinder. Dataiku came from observability. Four doors into the same room, each sold as the thing that finally gives you the full picture.
BCG named the category in August. They call it the Enterprise AI Control Plane — one layer sitting above every platform, holding common identity, visibility and control.
And there’s a phrase in their own framing that should stop you cold. They call it “a new opportunity.” Not an obligation. An opportunity.
Here’s why that word matters.
For three years the pitch to buyers was the opposite. Model-agnostic. Multi-model. No lock-in. Then prices collapsed, open weights closed the gap, and swapping a model got cheap — because there was no margin left in that layer.
Lock-in doesn’t die when the layer commoditises. It moves. It moved up into the harness, and now it’s moving up again, into the layer that decides which agents exist, what they’re allowed to touch, and which ones are trusted.
And that layer is only worth buying if it sees everything. Which means the vendor’s commercial interest and your security interest point the same direction for exactly as long as it takes them to win the account. After that, they diverge.
Look at the Microsoft case, because it’s the honest test.
Agent 365 went generally available on 1 May 2026 — fifteen dollars per user per month standalone, or bundled into M365 E7 at ninety-nine. Registry, Entra agent identity, conditional access, Defender, Purview. Microsoft’s own documentation calls the agent registry the unified inventory of all agents in an organisation, Microsoft and non-Microsoft alike.
Now read the fine print. Copilot Studio agents built before 18 March 2026 have no automated path to agent identity, and Microsoft’s own guidance for production agents is to leave them on the old service principal and wait. GitHub’s Copilot coding agent runs in GitHub’s identity plane, so the governance of the agent writing into your repositories lives somewhere else entirely. Local agents — Cursor, Claude Desktop, Ollama — sit outside SaaS discovery, and at launch Agent 365’s local detection covered only agents built on Microsoft’s OpenClaw platform. Their documented route for third-party agents is a manual SDK integration, per agent, which most teams will never have the headcount to execute.
I’m not singling Microsoft out. They’re the most honest about their own limits, and that counts for something. The point is structural: the registry that tells you what you have is built by someone who only fully sees what they sold you.
Then there’s the number that should keep you awake.
Gartner, in May: the average Fortune 500 enterprise will manage more than 150,000 AI agents by 2028, up from fewer than fifteen in 2025. Same house, same year: by 2027, 40 percent of enterprises will demote or decommission autonomous agents because of governance gaps they only found after an incident hit production.
They’re selling you the scorecard before anyone has fixed the thing you’re scoring.
That’s not a reason to skip it. It’s the reason to own the file. Because whatever the tool concludes about your fleet — who’s drifting, who’s risky, who gets retired — that judgement now lives in a dashboard you rent, produced by a vendor whose definition of “risky” was shaped to make their product look necessary.
Forkast, covering the Dataiku launch, wrote the sentence that belongs taped to every procurement desk: governance tool sprawl — managing the tools that manage the agents — is its own emerging problem.
The operator lesson. Four things, and none of them are expensive.
One. The inventory is an asset you own, not a subscription you renew. Plain file. Agent name. Human owner. What it can reach. What it was approved to do. When it was last reviewed. If your vendor’s dashboard dies tomorrow, that file is still your company.
Two. Identity first, then telemetry. The governing question is simple — who can tell me what this agent did last Tuesday without asking the agent, or the agent’s vendor. If the only answer costs a licence, you’re renting your own audit trail.
Three. Every control plane grows an incentive, so name it in the contract while you still have leverage. Who pays the auditor. Who can fire them. Can you pull the raw log, or only the summary someone else wrote.
Four. Fix the boring thing first. Oasis Security’s teardown of Agent 365 makes the point that every agent inherits the permissions of whoever invokes it. Agents don’t create your exposure. They inherit it. If your shared folders are a mess, no registry will save you.
And the human part, because there is one.
An agent is authority handed to something that cannot be held responsible. The moment you lose the ability to name them, you’ve lost the ability to revoke them. A registry is not paperwork. It is the list of things acting in your name. Not knowing that list isn’t a management problem. It’s a consent problem.
So the principle: the right to know what is acting for you — and to hold the list yourself rather than rent it. Buy the tool if it earns its place. Keep the ledger.
You’ve got this.