By Josh Woodruff, Co-chair, CSA Zero Trust Working Group. Reviewed by Josh Woodruff. Published October 2026.
Build it as one playbook on one sheet. Give every agent a row with the fields you'd need to stop it. Put one named person on each row as the owner. Set the approval tier by what the agent can do, and put a review date on it. That's what NIST AI RMF GOVERN and ISO/IEC 42001 ask for in plain terms. The Agentic Trust Framework is how you run it for agents that act.
People often run the inventory as one project and approvals as another. Split up, each one stalls. Run together, they fit on a spreadsheet you can use this quarter.
This page ties together our deeper posts on counting agents, one accountable human, and what approval means.
What fields belong in an AI agent inventory record?
Each row needs enough to act on: who the agent is, who owns it, what it can reach, and how you stop it. If you can't revoke the agent from what's on the row, the row isn't done.
Start with a spreadsheet. You don't need a platform to begin. You need rows you can act on.
Do this: Put these fields on every row.
Unique agent name or ID, plus version or template ID
Named human owner (one person)
Systems and data the agent can read
Actions the agent can take (write, send, pay, change permissions)
Kill or revoke path (who can pull it, and how)
Approval tier or ATF maturity level (Intern through Principal)
Last reviewed date and next review or expiry date
Optional: identity or credential type, and whether the agent was declared or discovered
The how many agents post covers the core inventory shape. The ownership post covers what makes a row real. This playbook adds the tier and the next review date. It also adds a short failure definition, so people know what "bad" looks like before it happens.
How do I find AI agents we don't already know about?
Start with cheap discovery before you buy a scanner. Pull OAuth consent grants from your identity provider. Check finance records for AI spend. Ask leaders, one at a time, what their teams run. Then scan network logs for AI endpoints.
Declared means someone registered the agent on purpose. Discovered means you found it later. Both belong in the same sheet, and both get an owner.
Our read: Run discovery with amnesty plus registration. People hide agents if the first response is punishment. You want a complete list and a fair path to approval.
OAuth grants often find the agents that already hold access fastest. Finance records catch spend that never got a ticket. Leader interviews catch tools people built without telling security.
Do this: When you find an agent, name an owner and give it a temporary tier. Then set a date to finish the real approval.
Why does every AI agent need one accountable human owner?
An agent can't be fired or put on a performance plan, so accountability has to land on a person. The builder who benefits from the agent owns it. A team name is the same as nobody when something breaks at 2 a.m.
IT can own the platform the agents run on. Each agent still needs its own owner. Without one, nobody gets paged when a single agent misbehaves.
Do this: Write the owner's name and the scope they accept on the row, along with how the agent gets shut down for good. When the owner leaves, the row opens a review right away. That works the same way joiner-mover-leaver already works for human accounts. If the builder moves teams, update the row that week. If the builder leaves the company, freeze high-impact actions until a new owner accepts the scope in writing.
In the Agentic Trust Framework, this sits under Identity Management. The full operating rule lives in Every AI Agent Needs One Accountable Human.
How should approval tiers follow what the agent can do?
Set the tier by how much damage the agent could do and how easy it is to undo. Weak answers on identity, scope, data, failure response, or ownership get a narrow agent with a human on every high-impact action. Strong answers earn more room.
Our read: Map that ladder to ATF's maturity levels so promotion and demotion are written down. Which department asked first shouldn't decide the tier.
Fact: ATF's levels run Intern, Junior, Senior, and Principal (CSA, February 2, 2026):
Intern: observe and report only; continuous oversight
Junior: recommend; a human approves before the agent acts
Senior: act inside written limits; notify after
Principal: autonomous inside its domain; strategic oversight only
Demotion is allowed. A critical incident can drop an agent back down. Autonomy is earned, and it can be taken back.
Do this: Give a fast lane to agents that can't write to production, move money, message customers, or change permissions. Keep high-impact actions behind a gate outside the model that the agent can't talk its way past. Our post on how to stop an AI agent before it acts covers that gate.
When does an approved agent need re-approval or expiry?
Every approval needs an end date. Put a review date on every row. Trigger re-approval early when something real changes.
Watch two clocks. The calendar clock is the next review date on the row. The event clock is any change that shouldn't wait for the calendar.
Do this: Treat these as event triggers.
Owner changes or leaves
Scope grows (new systems, new data, new actions)
Tools or connectors change
A new data class appears in the path
A serious incident or near miss
Low-risk Interns can renew on a light check. Agents that spend money, message customers, or change permissions should renew with the same care as the first approval. If the scope grew since the last approval, run the full path again. If nothing changed and the agent stayed in its lane, a light renewal can update the date and keep the tier.
How does this map to NIST AI RMF GOVERN and ISO/IEC 42001?
NIST AI RMF GOVERN asks you to inventory AI systems and define roles. It also asks for review on a schedule. ISO/IEC 42001 asks for an AI management system with defined roles and resources. Your sheet is how those jobs show up for agents.
Fact: NIST released the AI RMF on January 26, 2023 (NIST AI RMF). The GOVERN playbook says:
GOVERN 1.6: mechanisms are in place to inventory AI systems. The playbook says an inventory may include system documentation and incident response plans.
GOVERN 2.1: roles, responsibilities, and lines of communication for AI risk are documented and clear.
GOVERN 1.5: ongoing monitoring and periodic review are planned, with roles defined, including how often reviews happen.
Our read: Your spreadsheet rows are the inventory. Your named owner is the role. Your review date is the periodic review.
Fact: In ATF's mapping on the ATF comparison page, ISO 42001 A.3 Internal Organization maps to roles and responsibilities, and A.4 Resources for AI Systems maps to agent inventory and credential management. Our read: Use that as a crosswalk. Your certification body still makes the call on ISO.
Where does the Agentic Trust Framework fit in this playbook?
ATF is the operating layer on top of the standards you already report on. Inventory and ownership feed Identity Management. Approval tiers and re-approval feed the Intern-to-Principal ladder.
Fact: The Cloud Security Alliance published ATF on February 2, 2026, under CC BY 4.0 (CSA). I created it and donated it. It turns five questions into 25 requirements you can score. The five elements are Identity Management, Behavioral Monitoring, Data Governance, Segmentation, and Incident Response.
Use the public spec at agentictrustframework.ai and the compare crosswalk to show auditors how it maps to NIST and ISO. ATF sits alongside those standards. To see how ATF fits next to the other frameworks a CISO already has, read What is an AI agent security framework for CISOs?.
Related questions
Do I need a new platform before I start an agent inventory?
You can start with a spreadsheet and the fields above. Add a platform when the list gets too big to trust by hand, or when you need automated discovery. Get the playbook working first.
How is this different from our existing application or model inventory?
Those inventories track software and models. An agent inventory tracks software that acts. It records what the agent can read and change, how you stop it, who owns it, and when approval expires. If your current inventory can't answer those, it isn't ready for agents yet.
Book a Consult
If you want help standing this up, book a 90-minute agent trust assessment. We'll walk your agent list against the five ATF elements and leave you with a fix list in priority order. Book a Consult. You can also start with the free assessment.