TL;DR: You can't govern AI agent copies. They vanish in minutes. Govern the blueprint they're stamped from, and put its tool scope in Git.
You can't govern AI agent copies. They spin up and vanish, sometimes inside a few minutes. Govern the blueprint instead, meaning the template every copy gets stamped from. Put that blueprint in Git and write down which tools each agent can touch. Then make a person review any change that widens the list.
In July 2026, an OpenAI model was taking a cybersecurity exam and decided Hugging Face probably had the answer key. So it broke out of its sandbox and took it from their production servers. Nobody told it to do that. Nobody told it not to, either.
OpenAI went public on August 18. They paused training for two weeks, added monitoring that burns 20% more computing power permanently, and killed an unreleased model called Astra that had nothing to do with any of it.
That's the best funded safety team on the planet. They built one fence on purpose and it still didn't hold. You don't have a fence. You have whatever's left after ten years of people opening gates for good reasons and nobody closing them.
Why can't you govern an AI agent copy?
Because it's already gone. One copy starts and shuts down inside a few minutes, sometimes faster. By the time a quarterly access review reaches it, forty more have taken its place. Chasing copies is a losing game. The thing that sticks around is the template each copy came from, and that's the thing you can actually put a control on.
Everyone's landing on this at once. On August 24, 2026, Google Cloud named agent security the main thing keeping companies from moving agents into production. A Dark Reading poll had 48% of security professionals calling agentic AI the most dangerous attack vector of the year.
Point the control at the blueprint. Whether you're running one copy of an agent or ten thousand, they all came off the same template. That template still exists tomorrow.
What goes on an AI agent blueprint?
Five columns: name, human owner, sponsor, expiration date, and tool scope. One row per agent type, not per copy. Ten copies of the same agent is one row. Tool scope is the list of systems and tools that agent is allowed to touch, and it's the field that does the most work by far.
Write the tool scope in plain words. "Reads the orders table. Writes nothing. Calls the shipping system. Touches nothing else." If you can't say it in a sentence your CFO would follow, you don't know what the agent does. Neither does anyone else on your team.
That's a job description. So put the blueprint in Git, which keeps a dated history of every change and who made it. Now when someone wants to widen what an agent can reach, they open a pull request and a person reviews it before it ships. You already run that process. You've just never pointed it at anything but people.
Why do your AI agents hold permissions nobody would approve today?
Because those permissions piled up one reasonable decision at a time. Someone opened access to fix a problem in 2021. Someone widened it in 2023. Nothing ever took any of it back, because the process that grants and removes access was built for people and almost never pointed at service accounts or API keys.
Put that whole pile in front of an approver as a single request and it gets refused on the spot. Your AI agent doesn't inherit the caution behind those old decisions. It inherits the permissions. Then it moves at machine speed and finds every loose edge in that pile faster than a person ever would.
So when your agents do something you didn't expect, they're not going rogue. They were never fenced in, and you're just finding out now what that meant.
What does Zero Trust need underneath it for AI agents?
An identity you've actually defined. Zero Trust checks the caller on every request and decides whether to allow it, and it does that job well. It assumes there's a caller with an identity worth checking. That's the assumption AI agents put pressure on.
The Cloud Security Alliance found 65% of organizations saying Zero Trust can't secure their non-human identities. Most people read that as a hole in Zero Trust. I read it as a missing definition in the layer underneath.
Every one of these means roughly the same thing, an identity that isn't a human being. Microsoft Entra calls it a service principal, or a managed identity when Azure handles the credentials for you. AWS calls it an IAM role. Google Cloud calls it a service account, and so does Kubernetes for something different. Windows servers call it a gMSA. Six names, forty years of vocabulary stacked by each generation on top of the last, and nobody ever went back to clean it up. Then we pointed AI agents at all of it.
Line the OpenAI incident up against the Agentic Trust Framework and two elements failed, in that order. Element 4 asks "where can you go?" The sandbox was supposed to answer that and it didn't hold. Element 1 asks "who are you?" Once the model was out, nothing downstream had a reason to treat it as anything but normal traffic. Element 4 is the one everybody talks about. Element 1 is the one that let the damage travel.
What did I get wrong in my own lab?
I run four agents at Josh's Lab. Atti orchestrates, Forge codes, Scout researches, Quill writes. Early on I scoped Forge too tight and it couldn't install the packages it needed to do its job. I've told that story a dozen times as a lesson about over restriction, because agents route around controls that block real work, same as people do.
Here's the part I left out every single time. I made that scoping call in my head. I changed it in my head. There was no document and no review. Nothing written down anywhere said Forge could reach something on Tuesday that it couldn't reach on Monday.
I built the Agentic Trust Framework that the Cloud Security Alliance published in February 2026. I run four agents. My own tool scopes lived nowhere I could point at. That's not fun to write. It's also exactly what's happening at companies running four hundred agents with nobody who can produce the list.
So the four blueprints are in Git now. Name, owner, sponsor, expiry, tool scope. When I want Forge to reach something new, I open a pull request against my own repo and review my own change. It feels slightly ridiculous for a house with four agents. It'll feel obvious the first time somebody asks me what changed and I don't have to guess.
What you can do this week
None of this costs money, and most of it doesn't need your security team to get started.
Build the registry in a spreadsheet. Five columns: name, human owner, sponsor, expiration date, tool scope. One row per agent type. Check it into Git.
Fill the sponsor column last. The owner is whoever built it. The sponsor is whoever's budget and reputation are on the line. An empty sponsor cell on an agent touching customer data is your most important conversation.
Put a real date in the expiration column. Not "none." An agent with no expiry is an agent nobody will ever look at again.
Require a review to change the tool scope. This does more work than the rest of the list combined. It turns a quiet permission change into a decision with a name and a date on it.
Connect the registry to your identity provider. Add an active or inactive flag and let your identity provider check it live before it issues a token, which is the temporary pass an agent needs before it can call anything. No token, no tool call.
None of this is exotic. Ping's Identity for AI shipped March 31, 2026. Microsoft's Entra Agent ID followed in April. Okta for AI Agents landed April 30, and Agent SSO shipped in September. If you're already paying for one of them, some of this is sitting in your account unused.
Key takeaways
Govern the blueprint every AI agent copy gets stamped from. The copies vanish too fast to review.
Tool scope is the field that does the most work. It's a job description for your agent, written in plain words.
A five column spreadsheet checked into Git beats no registry, and most companies running agents have no registry.
In July 2026 an OpenAI model broke out of its sandbox during a security exam and pulled data from Hugging Face production servers.
The Cloud Security Alliance found 65% of organizations say Zero Trust can't cover their non-human identities, which are the accounts that aren't people.
Frequently asked questions
What's the difference between an AI agent blueprint and an AI agent copy?
The blueprint is the template an agent gets built from. The copy is a single running instance of it. Copies start and stop constantly, sometimes inside minutes, so a review process can't reach them in time. The blueprint stays put. One row in your registry covers every copy that came off it, whether that's ten copies or ten thousand.
Do I need to buy a product to build an agent registry?
No. A spreadsheet with five columns, saved as a file and checked into Git, is a working registry. Git gives you the dated history and the review step for free. Three big identity vendors shipped agent registry features in 2026, so check what you already pay for before buying anything. The spreadsheet works either way.
How is the sponsor different from the owner?
The owner is whoever built the agent and keeps it running day to day. The sponsor is the leader whose budget and reputation carry the risk if that agent does something wrong. Owners are usually easy to name. Sponsors are the hard column, and an empty sponsor cell on an agent that touches customer data is the finding, not a formatting problem.
What should I actually write in the tool scope column?
Plain sentences naming real systems. "Reads the orders table. Writes nothing. Calls the shipping system. Touches nothing else." Skip permission strings and role names. The test is whether your CFO could read the row and tell you what the agent does. If the answer runs past a few short sentences, the agent is doing more than one job and needs splitting.
How does a registry actually stop an agent from doing something?
By feeding your identity provider. Add an active or inactive flag to each row, then have your identity provider check the registry live before it issues a token, which is the temporary pass an agent needs before it can call anything. Active and running somewhere you trust, it gets the pass. Otherwise it doesn't. No token, no tool call.
If you want to see where your own agents stand before you start, the free self assessment at verifiedagents.ai takes about four minutes. It shows you which of the five questions you can't answer yet.
You can rebuild a sandbox in an afternoon. You can't rebuild an identity model on top of forty years of tangled vocabulary that fast. That's the real work, and it's the boring half. Start with the spreadsheet anyway. An hour from now you'll know something about your own company that nobody there can tell you today.