Give Every Agent a Manager

An agent registry tells you what exists, and it does not tell you who answers for it.

1,500 agents and 1,500 managers

LTM runs 1,500 AI agents, and its CISO said in ServiceNow's AI Passport announcement that each one has an employee ID and a manager, tracked in a single system of record. That is the most useful governance detail I read this week, and it has nothing to do with technology. Treat it as a vendor-supplied example, not an audit. AI Passport itself is expected in Q4, so the product is not generally available yet. The practice does not need the product.

An inventory is not accountability

I have written about the inventory problem: you cannot govern what you do not know you have. Fine, but a list of agents with no named human beside each one is a list nobody is accountable for. The registry answers "what." Somebody still has to answer "who." (Shared service accounts taught us this lesson years ago. The account is in the inventory, the owner left two reorganizations ago, and the first person to ask who is responsible gets a long silence.) Agents will repeat that pattern at a much faster clip unless ownership is part of how they come into existence, not something you reconstruct after an incident.

Three moves

Assign the owner at provisioning, before the agent runs, and make it a named person instead of a team alias. Record the owner in the registry next to the agent so the inventory answers "who" as well as "what." Then make the owner the approver for high-impact actions. Microsoft's new agent controls also route consequential actions to a human, and that human needs a name before the moment arrives. This is the kind of unglamorous step that sits at the center of my practical guide to agent governance.

What to do

Pick one agent running in your environment today. Can you name the person who would get the call if it did something wrong?