The Agent Registry

The agent registry

Before you build a single agent, build the list of them.

---

The failure it prevents

Six months into a programme, the question arrives from somewhere above: how many agents are running?

Nobody knows. Not approximately, not within a factor of two. There is a number in a slide from March, and a shared drive with some prototypes in it, and a team that stood something up without telling anyone because nobody said not to.

This is the second failure on the list of why programmes stall, and it is the cheapest one to have prevented.

The rule

_{The boundary is the gateway, not the spreadsheet. That is the whole difference between a registry and an inventory.}

No registry entry, no API key.

That is the whole mechanism. The registry is not a spreadsheet somebody maintains out of diligence. It is enforced at the gateway: an agent that is not in it cannot make a request.

A registry that is not enforced is an inventory, and an inventory decays the day it is written. The difference between the two is one integration.

It costs almost nothing to create and it has to exist before the first agent, not after the first audit. Retrofitting a registry means going and finding things, which is the expensive version of the same work.

The minimum fields

Anything less than this and the registry cannot answer the questions it exists for.

Field	The question it answers
Agent ID	Unique and permanent, assigned at inception. Not the name, which changes
Name and description	What a human calls it
Business owner	A person, contactable. Not a team, not a distribution list
Risk tier	1 to 4, assigned by governance review rather than self-declared
Date deployed	How long it has been running unexamined
Last risk review	The field with a date that goes stale. A review date in the past is a finding a dashboard will never raise
Data sources accessed	What it reads
External systems called	What it can reach, which is the blast radius
Sensitive-data classification	Handles regulated data · handles masked data · handles neither
Circuit breaker configuration	The trigger conditions and who is contacted
Golden dataset last updated	Whether the thing testing it still resembles the work
Next scheduled evaluation	The second field that goes stale
Status	Active · shadow · suspended · retired

Three of these fields are dates, and they are the ones that make the registry an instrument rather than a list. A registry you can sort by last reviewed tells you what to look at on Monday. One without dates tells you what exists.

Tools need one too, and for a sharper reason

An agent's registry entry says what it can reach. The tool registry says what those things do, and it exists because of a gap most teams meet late.

The API gap. An agent given a raw API is given a surface designed for a programmer who already knows the domain: dozens of endpoints, implicit ordering, undocumented preconditions. Agents do not do well with that, and the failure looks like reasoning failure when it is interface failure.

The answer is task-centric wrappers. Not here are forty endpoints, but here is "submit a claim", and it validates its own inputs. The wrapper is where validation lives, because validation in a prompt is a request and validation in a wrapper is a rule.

Which means every tool is a governed asset, with an owner, a tier, and a record of what it is allowed to do. A tool registry is not bureaucracy added to a tool. It is the place the wrapper's contract is written down.

What the registry gives you that nothing else does

An answer to the shadow-AI question that is not a guess. Run an amnesty periodically: anything registered in the window is brought onto the paved road with support, no consequences. After the window, the gateway is the enforcement.

A denominator. Every programme metric that matters is a ratio, and without a registry there is no bottom half. How many agents have a golden dataset is unanswerable if you do not know how many agents there are.

A list to sort by risk. The first question in any incident is which other agents look like this one. The registry answers it in seconds.

A retirement path. Agents that nobody uses keep costing money and holding credentials. Status: retired is a field that only exists if something made you look.

_{The registry fields and the API-key rule are adapted from the AI CoE and Agent Factory Playbook, based on The Augmented Enterprise framework.}

_{Back to Home · Governance as code · The framework spine}