The AI Agent Inventory: Ten Fields to Know Before You Govern Agents
On October 16, Anthropic published how employment is changing inside the company . One figure stands out. In March 2026, the combined hours worked by its autonomous and interactive agents passed the hours worked by its employees for the first time. By August, agents directed by individual employees
Posted on Oct 28 • Originally published at codacon.ai
On October 16, Anthropic published how employment is changing inside the company. One figure stands out. In March 2026, the combined hours worked by its autonomous and interactive agents passed the hours worked by its employees for the first time. By August, agents directed by individual employees worked six times as many hours as their human handlers.
Read the caveats before quoting the number. It describes one company at the frontier of adoption. Agent time is measured as runtime, including inference and tool use. Human time is headcount multiplied by an assumed 40-hour week. The authors note that adoption was not random and that the company was growing fast, so the productivity estimates have limits.
The security point survives every caveat. When agents work more hours than people, most of the activity under your credentials is no longer human. Your security model was built for occasional AI interactions: a person asks, a model answers. It now has to cover persistent machine identities doing work continuously, often while no one is watching.
Most organizations already have a list of AI. It usually names vendors and use cases: "Copilot for engineering," "chatbot on the support site," "contract summarization pilot." That list answers a procurement question. It does not answer a security one.
An incident responder needs different facts. Which identity did this agent act as? What could it reach? Who owns it? How do we stop it? The incident response practices NIST, NSA and CISA published in October assume you already know. Practice 3.1 asks you to define each agent's intended scope so you can detect deviations. Practice 1.7 asks for a way to terminate agent activity quickly. India's CERT-In, after agents under evaluation reached live corporate systems, told organizations to give each agent run its own short-lived, least-privilege identity.
Every one of those controls presupposes an inventory with the right columns.
Microsoft reached the same conclusion on October 19. In Agents are your newest insiders, it argues that every agent needs "a first-class identity distinct from the person using or sponsoring it," should start with no permissions, and should run inside a controlled environment, with the controls sitting outside the model. Its summary: "We should not ask a model to be its own security authority." An inventory is how you check that this holds for each agent, one record at a time.
One record per agent. An agent here means anything that takes actions with tools under an identity: a coding agent in your pipeline, a support agent that issues refunds, an automation that reads email and files tickets. For each field, the question to ask and the answer that should worry you.
If you cannot fill in a field, you have not failed the exercise. You have found the first finding.
Here is the record for a common case: an AI coding agent that runs in the CI pipeline, fixes failing tests, and opens pull requests. The values are illustrative, typical of what a first pass finds.
That took less than an hour, and it produced five findings, each with an obvious fix: remove the deploy token from the job, scrub the fixture, put an egress allowlist on the runner, log tool calls to the central log platform, and add a tested revocation step to the runbook. None of them required a governance framework.
The first record is easy because you chose the agent. The hard part is the ones nobody told you about. Look in these places:
Each source finds agents the others miss. Run all of them once, then make the inventory a gate: no agent gets a production credential without a complete record.
The inventory is not the goal. It is the prerequisite for everything else.
Our GenAI Security Readiness Assessment starts with this inventory. We discover the agents, build the records with your owners, test the kill mechanisms, and turn every gap into a finding with an owner, a severity, and a remediation. You keep the inventory and the process to maintain it.
Pick one agent this week and fill in its record. The first one takes an hour. It is also the first evidence that your agent governance exists outside a policy document.