There is a specific kind of mess that arrives about nine months into serious AI adoption. Nothing has broken. No one has been breached. But if you ask a simple question — how many agents are running in this business, and who is responsible for each one? — nobody can answer, and the people who might know have all half-forgotten the thing they built in an afternoon four months ago.
That is not a security problem yet. It is an ownership problem, and it is the cheapest one you will ever fix, because fixing it requires no new software and no budget. It requires a list and a rule.
This playbook is the version that survives contact with a real team: small enough to actually run, specific enough to be useful the same week. It assumes you have somewhere between three and fifty agents, that at least some were built by people who do not write code for a living, and that you would rather not find out how many there are during an audit.
Part 1 — The register (90 minutes, once)
One table. Not a tool, not a project — a spreadsheet with seven columns. If this takes more than a morning you have over-engineered it.
- Name. What it does, in plain words. “Chases overdue invoices,” not “AR Automation v2.”
- Owner. One human. Not a team, not a function — a person, by name.
- Trigger. What sets it running: a schedule, a webhook, a human clicking something, another agent.
- Reach. Every system it can touch, and whether that access is read or write. This is the column that will surprise you.
- Blast radius. The worst thing it can do if it misfires at 3am with nobody watching. One sentence.
- Last reviewed. A date. Blank counts as never, and never is the answer for most rows on day one.
- Expiry. The date it gets switched off unless someone renews it. More on this below — it is the load-bearing column.
How to actually find them all. Asking “does anyone have agents running?” in a team channel gets you about a third of them, because people do not think of their Zapier-plus-a-model workflow as an agent. Better prompts, in order of yield:
- Pull the API-key list from every model provider you pay. Every key belongs to something. Any key nobody can account for is a finding in itself.
- Check the OAuth-connected apps list on your Google Workspace or Microsoft 365 tenant, and on your CRM. Agents leave fingerprints there.
- Ask each team lead a concrete question instead of an abstract one: “What runs on its own overnight that you would notice if it stopped?”
- Search your automation platforms for anything whose steps include a model call.
- Check the AI features in software you already bought. These often count as agents, act with your permissions, and were provisioned by nobody.
Part 2 — The owner contract
“Owner” is meaningless until it means something specific. Four obligations, and they are deliberately light — a heavy contract is one nobody accepts.
- You know what it touches. You can name every system in the Reach column without looking. If you cannot, you do not own it; you inherited it.
- You see it fail. Failures route to you — an email, a channel ping, anything — not to a log file nobody opens. An agent with no failure path is an agent that has been succeeding in your imagination.
- You renew it or you kill it. At expiry you make an active decision. Silence means off.
- You hand it over properly. If you leave the team, ownership transfers by name before you go, or the agent gets switched off. No orphans.
The transfer clause matters more than it looks. Orphaned agents are overwhelmingly the ones still running with credentials from someone who left eighteen months ago.
Part 3 — The four-question intake
Applies to every new agent before it runs on anything real. Four questions, answered in writing, in under ten minutes. Anyone can build an agent; this is what they fill in before it goes live.
- What is it allowed to touch, and why that exact list? The test is whether the builder can justify each item individually. “It needed access” is not a justification; it is what allow-all sounds like when it is explaining itself.
- What does it write? Read-only agents are a different risk class from anything that sends, posts, pays, deletes or modifies. Be explicit about which side of that line it sits on, and if it writes, whether anything is irreversible.
- How does someone stop it? There must be a named kill switch a non-builder can reach: revoke a key, disable a schedule, flip a flag. If the answer is “message me,” that is not a kill switch, that is a dependency on one person’s phone.
- What would tell you it has gone wrong? One observable signal — volume above a threshold, errors above a rate, a spend ceiling. Not a vague intention to keep an eye on it.
If a builder cannot answer all four, that is not an obstruction; it is the intake doing exactly its job. It has told you the agent is not ready and cost you ten minutes to learn it.
Part 4 — The review cadence
Three checkpoints. The whole point is that they are short and boring.
Day 30 — does it still do what it was built for? Fifteen minutes with the owner. Read a sample of its actual output, not the summary of its output. Most agents have drifted by now, usually because the thing they were built to handle changed shape and nobody told the agent.
Day 90 — is it still worth its footprint? Three numbers: what it cost, what it saved, how many times it needed human rescue. An agent that needs rescuing weekly is a manual process wearing a costume, and it is fine to say so out loud.
Every quarter — the whole register in one sitting. Read down the Owner and Last reviewed columns. Any row with a departed owner or a review date older than six months gets switched off, not investigated. Investigation is how registers rot; switching off is how they stay honest. If something important stops, someone will tell you within a day, and now you know it was important.
Part 5 — The retirement rule
Every agent gets an expiry date at creation. Ninety days for anything experimental, a year for anything load-bearing. At expiry the owner renews it in one line or it goes dark.
This single rule does more work than the other four parts combined, because it inverts the default. Without it, an agent’s natural state is running forever, and someone has to make a case to stop it — which nobody ever does, because arguing to remove something that has not visibly broken is a losing move socially. With an expiry, the natural state is off, and continuing requires thirty seconds of active intent. The pile stops accumulating on its own.
A worked example
A twelve-person B2B services firm ran this and found nine agents. They had guessed four.
Two were unambiguously good: a proposal drafter and a meeting-notes summariser, both owned, both reviewed, both renewed for a year. Three were doing real work but had drifted — a lead-scoring agent was still applying criteria from a product they had repositioned in January. Rescoped in an afternoon.
Two were duplicates. Sales and marketing had independently built agents that summarised the same inbound enquiries into different spreadsheets. Neither team knew the other existed. Killed one, gave the other two owners’ worth of requirements.
One was orphaned: built by a contractor who finished in April, still running nightly with a live API key, writing to a shared drive nobody read any more. Off.
The last one was the finding. A CRM tidying agent had been given write access to the whole CRM because that was the default scope on the integration, and it had been quietly correcting fields for five months. Nothing had gone wrong. Nothing had been checked either. Rescoped to two named fields, and the owner set a spend-and-volume alert in about ten minutes.
Total cost: one morning, plus about three hours of follow-up. No incident, no tooling, no budget line.
Six ways this goes wrong
- Making it a platform project. The instinct is to buy a governance tool. Buy one later if the register outgrows a spreadsheet — and it probably will not.
- Assigning ownership to a team. “Owned by Operations” is owned by nobody. A name, or it is orphaned.
- Auditing instead of switching off. The quarterly pass has to be able to kill things quickly, or it becomes a meeting about a spreadsheet.
- Treating vendor AI features as out of scope. They act with your permissions on your data. If it takes an action, it goes on the register.
- Reviewing summaries, not output. Agents are extremely good at reporting that they did the thing. Read a sample of the actual thing.
- Skipping the expiry column. Everything else degrades into a document. The expiry date is what makes it a system.
Your first week
Monday: build the seven-column sheet, fill in the agents you already know about.
Tuesday: run the five discovery prompts from Part 1. Expect the count to roughly double.
Wednesday: assign a named owner to every row. Any row that cannot get one goes dark on Friday.
Thursday: fill in Reach and Blast radius. Rescope the worst two.
Friday: set expiry dates, switch off the orphans, and put the quarterly review in the calendar as a recurring event.
That is the whole thing. The reason it is worth a week is not the agents you find — it is that from then on, every new agent arrives with a name on it, and the pile stops growing in the dark.