Section 3
Discovering assets and baselining the current state
Organizations already run an average of 12 agents, and half of them operate in silos rather than as part of a coordinated system.2 Because nothing can be governed until it is visible, Phase 1 of the handbook’s phased plan starts with an inventory: register every agent, API and MCP server, then route model and tool traffic through one gateway. Discovery applies the same idea to one use case: find every asset it touches, who owns it and how it is controlled today, and measure how the process performs before anything changes.
What to inventory
Template T3 has eight parts, one for each asset category. Fill them from the workshops, the client’s documentation and, where the client allows, tool-assisted discovery.
| Template | Asset category | What to capture | Where to find it | Why it matters |
|---|---|---|---|---|
| T3a | Applications and systems of record | System, owner, role in the use case, interfaces (API, event, file), read or write, data classification, hosting, constraints |
|
|
| T3b | Data assets and master data | Domain or data set, system of record, golden record (yes or no), quality issues, sensitivity, owner or steward, lineage |
| Agents are only as reliable as the data and context they act on. |
| T3c | Integrations, APIs, events and MCP tools | Interface or tool, system, operation, read or write scope, protocol, exists today or to build, owner |
| Capabilities exposed once, as governed APIs and MCP tools, are reusable by every agent. |
| T3d | Agents and copilots | Agent, responsibility, platform, owner, autonomy tier, tools used, human role, status (live, pilot, planned, shadow) |
| An agent no one can see cannot be governed, and every agent needs an owner and a tier. |
| T3e | Models | Model, provider, hosting (SaaS, VPC, on premises), tasks, data retention terms, regions, cost basis, fallback |
| Routing, cost and confidentiality rules are set per model. |
| T3f | Identities, users and channels | User group or agent, channel, authentication, authority, approvals they give, volume |
| Every actor, human or agent, needs an identity and bounded authority. |
| T3g | Policies and controls | Policy or control, type (gateway, data, approval, limit, regulatory), where it is enforced today, owner, gap |
| Policies must be enforced at runtime in the gateway path, and writing them down in a spreadsheet does not do that. |
| T3h | Infrastructure, runtime and observability | Environment, network zone, runtime, keys and secrets, logging and monitoring, residency constraints |
| Deployment choices decide where gateways, MCP servers and data can run. |
How to run discovery
- Send the data request first. Ask for the documents and data below a week before the first workshop, so the workshops can confirm what the client has already sent.
- Walk the process with the people who do it. Use real, recent examples. Note every hand-off, re-keying step and wait.
- Inventory the AI estate. List agents in production, pilot and planning on every platform, with owners and autonomy. Add the models, providers, contracts and data-retention terms, and the APIs, events and MCP servers. Where the client allows, run Agent Scanners to discover agents and MCP servers across ecosystems.21 Record each agent’s sponsor, and which native control plane, such as Agent 365, Amazon Bedrock AgentCore, Gemini Enterprise Agent Platform or Agentforce, already governs it.
- Trace the data. For each agent, find the master data it depends on, its golden record (if any), quality issues, sensitivity and lineage.
- Find the policies. Record the approvals, limits, data rules and regulations that apply, where each is enforced today and where it is only written down.
- Validate with the owners. Every row in the inventory has an owner who has confirmed it. Unknowns become open questions in T12.
Finding shadow agents
Shadow agents are common: in a survey Microsoft commissioned, 29% of employees had turned to unsanctioned AI agents for work tasks.9 Personal and team-built agents often run outside any inventory, on laptops or in SaaS tools, with access to email, files and credentials. Ask about them directly, check endpoint and identity logs where the client permits, and make the governed path the easy path: a registry, a gateway and sanctioned capabilities that agents can use safely. Decoy credentials and decoy MCP tools that no sanctioned agent should touch can reveal agents working outside the governed path. A custom gateway policy family can plant and watch such decoys (handbook Section 7).
Every agent has a lifecycle
Agents need the same lifecycle discipline as the people and systems they work alongside. Deloitte recommends managing agents much like a workforce, from onboarding and digital identities to human supervisors at key decision points and, eventually, retirement planning.13 Microsoft’s Cloud Adoption Framework calls for one governance layer that enforces identity, ownership, access control and monitoring for every agent.14 Record where each agent stands:
| Stage | What happens | Enforced by |
|---|---|---|
| Propose | A business owner names the use case, the value expected and the autonomy tier requested | Intake in the agent registry |
| Register and onboard | The agent gets an owner and a sponsor, a risk tier, a system card and its own identity |
|
| Evaluate | It is tested against its success criteria and a red-team suite before it acts | Evaluation service |
| Promote | It moves up a tier only on evidence |
|
| Operate and monitor | Its traffic, cost and behavior are observed and limited |
|
| Recertify | On a schedule, its sponsor confirms that it is still needed, in the right tier and with the right permissions | Registry review workflow |
| Retire |
|
|
In T3d, give every agent a sponsor, its lifecycle stage, its next recertification date and its retirement criteria. Agents without an owner are the ones that linger: assign a sponsor at registration and move sponsorship when people change roles, as Microsoft Entra Agent ID does automatically to prevent orphaned agents.12
Baselining the KPIs
Measure the process before it changes, in the scope the first phase will cover. Use system timestamps where they exist (for example, from the event that starts the process to the one that ends it), a short time study for manual effort, and finance data for cost and revenue effects. Agree the method and the numbers with the business owner and the finance partner (template T6).
A baseline of “not measured” is a finding in its own right. For most clients, governed AI traffic, AI cost per outcome and agent evaluation pass rates are not measured at all today. The first phase makes them visible. Cost visibility is a common gap: in KPMG’s second-quarter 2026 pulse, only 26% of organizations had full, real-time visibility into what their AI systems cost to operate.8
The data request
- Process documentation, volumes and service levels for the use case. Recent examples of cases that went well and badly.
- Application portfolio or CMDB extract for the systems involved, with owners and hosting.
- API catalog (for example, MuleSoft Exchange), integration inventory and any MCP servers in use.
- List of AI agents and copilots in production and pilot, with platform, owner, sponsor and purpose, and any agent control planes already in use (such as Agent 365, Amazon Bedrock AgentCore or Agentforce).
- Model provider contracts or terms (data retention, regions), and AI spend for the last quarter by owner and use case if available, ideally as billing data in the FinOps Foundation’s FOCUS format.23
- Data catalog or MDM documentation for the domains involved, with known quality issues.
- Security policies for identity, access, data classification and approvals. Applicable regulations and audit findings.
- Baseline data for the candidate KPIs: cycle times, effort, error or exception rates, cost and revenue effects.