ISACA's agent-security guidance, published this month, lands on a blunt opening point: enterprises cannot secure AI agents they do not know exist. Inventory isn't housekeeping — it's the first control. Everything else depends on it.
Shadow agents are the new shadow IT, except worse: a shadow server hosts code; a shadow agent acts. It holds credentials, calls tools, sends messages, and makes purchases — and most were spawned by a well-meaning employee pasting an API key into a framework prompt.
What an inventory actually looks like
The framework we run for clients counts four registers per agent: identity (what credentials and names it carries), authority (which tools and scopes it can reach), data (what it reads and retains, including memory), and lineage (who deployed it, from where, under which approval). Most organizations can fill in identity within a week. Authority takes the longest — tool scopes hide in config files and framework defaults.
# agent register — minimum fields before production agent support-drafter owner: cs-eng status: live identity oauth:gsuite+slack scopes: read/write rotated: 2026-10 tools 14 callable 2 write-capable, 0 gated memory thread-persistent retention: unset lineage deployed 2026-08 approver: none on file
From census to kill chain
The reason inventory is a security control and not a spreadsheet: every agentic kill chain we've demonstrated began or ended at an ungoverned agent. The poisoned-doc chain in our promptware writeup worked because the support agent's tool permissions were broader than anyone remembered setting. An attacker doesn't need your best-defended agent — they need the one nobody logged.
ISACA's list continues past inventory into trust boundaries, human approvals, and memory governance — all correct, all downstream of knowing what exists. If your agent count ends in a guess, that's the finding.