An Agent Inventory Is a Belief. A Register Is a Record.
Nearly every IT leader says they have a complete inventory of the AI agents running in their company. Two-thirds had an agent incident last year. Both are true, because an inventory is a claim people make and a register is a byproduct of execution. Only one of them can be wrong quietly.
What the numbers say
Guild.ai published The AI Agent Management Gap on September 22, drawn from a Morning Consult survey of 362 U.S. IT decision-makers at companies with 100 or more employees, fielded August 4–9, margin of error ±5 points. In that sample, 96.4% are confident their organization has a complete and accurate inventory of its AI agents. Also in that sample: 66.7% had an agent-related operational consequence in the past twelve months, 39.8% have logging or audit trails, 35.9% require an agent to be registered before deployment, and 60.6% think it likely that employees are deploying agents without formal approval anyway.
Guild sells agent-management software, so the framing serves the sponsor. But the figures come from a named pollster with a published field window, sample and error bar — more than most numbers on this subject can say. Read them for shape.
Gartner, at its Digital Workplace Summit in London on April 28, predicted that by 2028 the average global Fortune 500 enterprise will have more than 150,000 agents in use, up from fewer than 15 in 2025, with only 13% of organizations believing they have the right governance in place. Its six-step remedy puts "build centralized agent inventory" at step two, populated by discovery tooling.
Confidence is not the error
Read 96.4% confident against 66.7% surprised as executives fooling themselves and you get a bad prescription — more attestation, a quarterly sign-off that someone checked the list. The error is instrumental, and it has three parts.
The question was asked of people, who answer about the part they built. An IT decision-maker does know the agents their organization sanctioned. The agents that cause incidents are disproportionately the ones nobody listed — and when only a third of organizations require registration before deployment, the list is a courtesy.
A discovered inventory is accurate at the moment of the scan and decays immediately after. It answers "what did we find in the places we looked," which is a different question from "what is running," and the gap widens every time someone ships a script on a Friday.
An inventory counts things, and incidents are caused by actions. A perfect roster tells you nothing about what any of them did. You can hold a complete list and still not answer the question that matters at 2 a.m.: what acted, under whose authority, against which record, and when. Counting actors is not recording acts.
You cannot inventory your way to an answer about what happened.
Two different objects
The words get used interchangeably and shouldn't be.
An inventory is a list, built and maintained. Someone or something compiles it, it is true as of a date, and keeping it true is ongoing work that competes against other work and loses. Its failure mode is silence: a stale inventory looks exactly like a current one.
A register is a record that exists because the work could not have happened without producing it. If an action cannot execute without writing who did it, with what authority, to what, then the register is not maintained — it accumulates, and its completeness is a property of the execution path rather than of anyone's diligence.
An inventory is a document about the system. A register is a feature of the system. Only the second survives a bad quarter, a reorganization, or the departure of the person who cared about the spreadsheet.
It is the same move as putting a compliance obligation into the system as a dated, cited record instead of onto a wall calendar — the argument in The Deadline Moved. The Requirement Didn't. A maintained calendar goes stale the moment a date moves. One derived from obligations that each carry a citation, jurisdiction, effective date and deadline re-derives itself.
What this looks like in shipped systems
None of our products is an agent-inventory tool, and this is not an announcement that one is coming. The pattern shows up across them anyway because it is the same pattern — the record is a condition of the action, not a report about it.
LegiOS carries each compliance obligation with its citation, jurisdiction, effective date and deadline, which is what makes the calendar re-derivable rather than hand-kept. It also records the edge of its own scope: when a question exceeds what software should decide, it routes to an attorney rather than guessing.
LeafIQ runs routes, orders, deliveries and AR on one data model, so the delivery that gets invoiced is the delivery the compliance trail describes — nothing to reconcile at month end, because there are not two records.
In Casebound, the gating is explicit: a matter cannot open without a cleared conflicts check, an AI draft from the Lexwright engine cannot reach a client without a recorded attorney disposition, and every mutation is audited — including from an administrative account. The audit trail is not a log someone remembered to turn on. It is the only path through which work happens.
LeoLog takes it to the limit, because there the record is the product. Each entry is hashed with SHA-256 and encrypted on the device, then anchored on-chain — Base for fast confirmation, Bitcoin via OpenTimestamps for durable finality. Only the fingerprint touches the chain. The proof bundle checks out at verify.leolog.io with no account, and would still check out if LeoLog did not exist.
For agents specifically, the two halves are worked out at MagenticOS: what an agent may reach, as a typed per-action capability rather than a prose instruction, in Capability-Based Security for AI Agents; and what it means for its work to be finished, in What "Completed" Means. An agent whose permissions are a typed grant is one you can enumerate without asking anyone: the grant is the entry.
The test
One question, for any system you run or are buying: if you deleted your agent inventory today, could you rebuild it tomorrow from records the system produces anyway?
If yes, the document was a convenience and what you have is a register. If no — if rebuilding means emails, interviews and a week of asking teams what they shipped — then you never had an inventory. You had a consensus — and 96.4% of your peers have one too.
The harder version is the one a skeptical outsider asks, which we worked through in You Can't Bill for an Outcome You Can't Prove: can someone who does not trust you reconstruct the claim from the artifacts? Not specific to software — a research process earns its keep because the rules were fixed before the trade, not narrated after it, the standing argument on the MacroSavant Substack.
Agent sprawl is being written up as a governance problem, and governance will get the budget. But the organizations able to answer questions about their agents in 2028 will not be the ones that bought the best discovery scanner. They will be the ones whose work already runs through a place that records the actor, the authority and the artifact — which is what we mean by an operating system for an industry.
We publish here as we learn. Subscribe by RSS, or write to hello@mutagenic.io.