Find every AI agent running in your company
Some of your AI agents log in as your employees. When one goes wrong, the log blames a person who was asleep. In one week, you'll know every agent and who owns it.
Why can't you just ask your teams what agents they're running?
You can ask. You'll get a short list, and it'll be wrong.
People build agents without calling them agents. A script with an API key (a password for software). A copilot someone hooked up to a shared drive over a weekend. A survey misses both.
So the census skips the survey. It reads the systems instead.
What's an agent identity census?
It's a one-week search for every AI agent in your company. Each one gets a row: what it does and who owns it.
Agents leave tracks in six places. The census reads all of them:
- Your identity provider (your login system), like Okta or Entra ID.
- Your secret store, the vault for software passwords.
- Your build pipeline accounts. These ship your code.
- Your AI gateway logs. They show which tools call which AI models.
- Your laptop and server data. It shows what's running where.
- Your expense reports. They show who's paying for AI tools.
The week ends with a working session for your team and a readout for your leaders.
What do you get at the end of the week?
Four things, all in writing.
- 01
The census
One row per agent. What it does, what it logs in as, the kind of password, the owner, the backup owner, and what it can reach.
- 02
The four findings
Every agent sorted into four problems, with counts. Agents logging in as a person. Agents sharing one login. Keys that never expire. Agents whose owner already quit.
- 03
The first fixes
A 90-day plan, riskiest first. Your team can start the first 30 days on Monday.
- 04
The leadership page
One page your board can read. How many agents you have, who owns them, what the worst one could reach, and what gets fixed first.
Why start with identity?
Every other AI control needs a name to work.
To stop an agent, you need to know which one it is. To handle an incident, you need a person to call.
That's why the Agentic Trust Framework starts with identity. Its first question for every agent is: who are you? Answer that, and the other four get easier.
See how the Agentic Trust Framework compares to other AI frameworks →
Who's this for?
Security and tech leaders at regulated companies of 1,000 to 10,000 people. Your agents are already live. And something's forcing the question: an audit finding, a board question, a customer security questionnaire, or a fresh incident.
If your agents are still in planning, start with the free assessment. Come back when they're live.
Who runs the census?
The people who wrote the standard.
We wrote the Agentic Trust Framework. The Cloud Security Alliance published it in February 2026. Thirty days later, a Microsoft team built its Agent Governance Toolkit against it, unasked. Berlin AI Labs has since mapped 12 live deployments to all five elements.
John Kindervag, who created Zero Trust, wrote the foreword to our book, Agentic AI + Zero Trust.
Our founder, Josh Woodruff, is Co-chair of the CSA Zero Trust Working Group. He's also Founding Chair of the Agentic Trust Framework at the CSAI Foundation. And we run identity for an aerospace defense contractor today.
That's who reads your systems.
What does this week leave out?
The census finds problems and recommends fixes. Your team makes every change.
Rotating keys and moving passwords come next, once you know what you have. Code review and tool buying sit outside the week too.
Vendor-neutral. No products to sell. Ever.
Frequently asked questions
How much of your team's time does it take?
A kickoff call and read access to the six systems. Keep someone on hand for questions. Plan on a few hours from your identity and platform teams, plus a working session on the last day.
Does a CMDB already cover this?
A CMDB (the list of systems IT tracks) knows what your teams added to it. Agents get built outside that process. The census goes straight to your identity provider and expense reports.
Can your team run the census on its own?
The table's simple. Knowing where agents hide is the hard part. Teams that go it alone usually find the agents they already knew about.
Is this an Agentic Trust Framework certification?
No. It covers one of the five elements: identity. A full check against all 25 ATF requirements is separate, bigger work.
What happens after the week?
Most teams handle the 30-day fixes on their own. They bring us back for the harder ones. Some move on to a full review of all five elements.
What does it cost?
The census is the first week of our AI Readiness Assessment. We size it to your setup, then quote it. To start smaller, take the free assessment or the Advanced ATF Assessment at $5,000.
The list of every agent in your company exists somewhere.
Right now it's split across six systems and three people's memories. Give it one week. You'll have it on one page, with an owner on every row.