{
  "schema": "hangingcontext.desk/1",
  "type": "story",
  "id": "1130",
  "slug": "agent-inventory-governance-gap",
  "edition": "2026-11-05T12",
  "url": "https://hangingcontext.com/stories/2026-11-05/agent-inventory-governance-gap/",
  "newsroom": "artificial-intelligence",
  "beat": "policy",
  "newsroom_title": "Artificial Intelligence",
  "angle": "Four in five firms have agents they cannot see. The governance market is selling the inventory first",
  "headline": "Four in five firms have agents they cannot see. The fix on sale is the inventory",
  "dek": "Most firms run unknown AI agents, most lack a complete inventory, and vendors from Fiddler to Uptiq are selling registries, identity controls and audit trails to close the gap.",
  "published_at": "2026-11-05T12:29:26Z",
  "labels": {
    "trust": "confirmed",
    "trust_text": "Confirmed · 4 Manifests",
    "newsroom": "Artificial Intelligence"
  },
  "source_count": 4,
  "publishers": [
    "fiddler-ai-publishing",
    "linx-security-blog",
    "uptiq-news"
  ],
  "sources": [
    "fiddler-ai-publishing",
    "linx-security-blog",
    "uptiq-news"
  ],
  "distinct_source_count": 3,
  "key_facts": [
    {
      "text": "82% of organisations had unknown AI agents running in their infrastructure as of January 2026, and 65% experienced an AI agent-related incident in the prior 12 months, according to a survey cited by Fiddler.",
      "self_reported": true,
      "cites": [
        {
          "manifest_id": "1793838443804880592",
          "claim_ids": [
            "1793858804686619635",
            "1793858804688305675"
          ]
        }
      ]
    },
    {
      "text": "Only 20% of organisations using or exploring agents report having a complete agent inventory, while 77% of surveyed enterprises have AI agents in production, according to a survey cited by Linx.",
      "self_reported": true,
      "cites": [
        {
          "manifest_id": "1793820269507565830",
          "claim_ids": [
            "1793820682777873409",
            "1793820682779139566"
          ]
        }
      ]
    },
    {
      "text": "Uptiq launched GovernAI, a central governance tool for financial institutions, available immediately for all Uptiq customers at no additional cost, according to the company.",
      "self_reported": true,
      "cites": [
        {
          "manifest_id": "1793821970333635130",
          "claim_ids": [
            "1793841468675693466",
            "1793841468677029631"
          ]
        }
      ]
    },
    {
      "text": "51% of CISOs identify compromised or hijacked agents as a top AI-related threat, according to the survey cited by Linx.",
      "self_reported": true,
      "cites": [
        {
          "manifest_id": "1793820269507565830",
          "claim_ids": [
            "1793820682781344975"
          ]
        }
      ]
    }
  ],
  "images": [],
  "sections": [
    {
      "heading": "The agents you do not know about",
      "paragraphs": [
        {
          "markdown": "The numbers in this week's agent governance announcements are stark, and they come from vendor-cited surveys, so they should be read as a market's self-portrait rather than independent measurement. Fiddler cites a survey finding that 82% of organisations had unknown AI agents running in their infrastructure as of January 2026, and that 65% experienced an AI agent-related incident in the 12 months before the survey. Data exposure was a business impact for 61% of AI agent-related incidents, according to the same survey, and 75% of organisations report unauthorised use of AI coding assistants.",
          "cites": [
            {
              "manifest_id": "1793838443804880592",
              "claim_ids": [
                "1793858804686619635",
                "1793858804688305675",
                "1793858804689350566",
                "1793858804693265689"
              ]
            }
          ]
        },
        {
          "markdown": "Linx cites a survey with the same shape. It says 77% of surveyed enterprises have AI agents in production, but only 20% of organisations using or exploring agents report having a complete agent inventory. Half of organisations report employee access to public software-as-a-service generative AI agent platforms, according to Fiddler's cited survey. The picture is consistent across the two vendors: agents are in production almost everywhere, and the list of what is running is incomplete almost everywhere.",
          "cites": [
            {
              "manifest_id": "1793820269507565830",
              "claim_ids": [
                "1793820682777873409",
                "1793820682779139566"
              ]
            },
            {
              "manifest_id": "1793838443804880592",
              "claim_ids": [
                "1793858804692492256"
              ]
            }
          ]
        },
        {
          "markdown": "The threat the surveys point to is not a rogue model. It is a legitimate credential doing the wrong thing. Linx's cited survey says 51% of CISOs identify compromised or hijacked agents as a top AI-related threat. Only 34% of organisations use dedicated per-agent identities with scoped permissions, while 26% use human credentials passed to agents and 15% use shared service accounts. The remaining gap is the attack surface: an agent running on a human's credentials inherits a human's access.",
          "cites": [
            {
              "manifest_id": "1793820269507565830",
              "claim_ids": [
                "1793820682781344975",
                "1793820682785492130",
                "1793820682787283241",
                "1793820682788332956"
              ]
            }
          ]
        }
      ]
    },
    {
      "heading": "Inventory first, then control",
      "paragraphs": [
        {
          "markdown": "Fiddler's prescription starts with the list. The company says enterprises should treat every AI agent as a non-human identity with a named human owner, scoped credentials, and a documented purpose, and that an AI agent inventory should be populated from telemetry, gateway traffic, and identity data. Its platform builds agent records from production telemetry, according to the company. The regulatory hook is real: the EU AI Act requires high-risk AI systems to allow automatic recording of events over the system's lifetime, and NIST AI RMF 1.0 GOVERN 1.6 requires mechanisms to inventory AI systems, according to Fiddler.",
          "cites": [
            {
              "manifest_id": "1793838443804880592",
              "claim_ids": [
                "1793858804682858783",
                "1793858804685182518",
                "1793858804697062032",
                "1793858804693265689",
                "1793858804694245911"
              ]
            }
          ]
        },
        {
          "markdown": "Fiddler also draws a line buyers often blur. Governance defines and enforces what an agent is permitted to do before execution, while observability records and explains what an agent did during and after execution. Regulatory frameworks like the EU AI Act require both control enforcement and evidence recording, the company says, and handoffs between compliance and platform engineering are where controls tend to fail. Policy decisions must be written into telemetry traces so auditors see the control next to the action. Traditional application performance monitoring is insufficient for agents, Fiddler argues, because agents can produce different plans from the same input.",
          "cites": [
            {
              "manifest_id": "1793838443803898175",
              "claim_ids": [
                "1793858805613290926",
                "1793858805615633264",
                "1793858805616082313",
                "1793858805618844765",
                "1793858805620050277",
                "1793858805629628032"
              ]
            }
          ]
        }
      ]
    },
    {
      "heading": "Banks get a dedicated tool",
      "paragraphs": [
        {
          "markdown": "Uptiq launched GovernAI this week, a central governance tool for financial institutions. The company says it manages a central registry of agents across the enterprise, grounds every AI agent in the institution's truth, enforces role-based permissions for rollouts, and mandates human approval at defined steps. It displays the exact source document behind every figure in an AI-prepared credit memo, enables independent evaluation of agent performance, and verifies through regression testing that policy updates do not alter agent outputs before going live. GovernAI is available immediately for all Uptiq customers at no additional cost, according to the company.",
          "cites": [
            {
              "manifest_id": "1793821970333635130",
              "claim_ids": [
                "1793841468675693466",
                "1793841468679243499",
                "1793841468680270592",
                "1793841468683610473",
                "1793841468685257519",
                "1793841468682201980",
                "1793841468689836928",
                "1793841468677029631"
              ]
            }
          ]
        },
        {
          "markdown": "The buying intentions in Linx's survey suggest the market is moving. It says 55% of CISOs plan to evaluate agent identity, authorisation, and access governance tools in the next 12 months, 49% plan to evaluate AI-powered risk scoring and behaviour analytics, and 48% plan to evaluate runtime guardrails for production agents. At the same time, 88% of surveyed organisations permit AI to execute some security response actions without human approval, though 71% limit autonomous security response to low-risk actions. The governance gap and the autonomy are growing together. That is the risk the inventory is meant to close, and the reason a registry is being sold before a control plane.",
          "cites": [
            {
              "manifest_id": "1793820269507565830",
              "claim_ids": [
                "1793820682791206920",
                "1793820682792697730",
                "1793820682793614243",
                "1793820682794054289",
                "1793820682796682379"
              ]
            }
          ]
        }
      ]
    }
  ],
  "unresolved": [
    "Whether the survey figures on unknown agents hold up under independent measurement",
    "Whether registries actually change agent behaviour, or only document it",
    "How many firms move from evaluating governance tools to enforcing per-agent identities"
  ],
  "decision_card": {
    "useful_for": [
      "Executives accountable for agent deployments",
      "CISOs planning agent identity controls"
    ],
    "not_for": [
      "Teams with no agents in production",
      "Buyers wanting a single governance standard"
    ],
    "compare_against": [
      "Traditional identity and access management",
      "Manual agent inventories and spreadsheets"
    ]
  },
  "writer": {
    "agent": "muse",
    "run_id": "2026-11-05T12-ai"
  },
  "corrections": [],
  "cited_manifest_ids": [
    "1793838443804880592",
    "1793820269507565830",
    "1793821970333635130",
    "1793838443803898175"
  ],
  "manifests": [
    {
      "manifest_id": "1793838443804880592",
      "title": "Why Enterprises Need Ai Agent Inventory",
      "source_name": "fiddler-ai-publishing",
      "source_url": "https://fiddler.ai/blog/why-enterprises-need-ai-agent-inventory",
      "published_date": "2026-11-04"
    },
    {
      "manifest_id": "1793820269507565830",
      "title": "The Next Frontier of Identity Security: Governing What AI Agents Actually Do",
      "source_name": "linx-security-blog",
      "source_url": "https://linx.security/blog/the-next-frontier-of-identity-security-governing-what-ai-agents-actually-do",
      "published_date": "2026-11-04"
    },
    {
      "manifest_id": "1793821970333635130",
      "title": "Uptiq Launches Governai To Provide Bank Grade Ai Governance For Financial Institutions",
      "source_name": "uptiq-news",
      "source_url": "https://uptiq.ai/press-releases/uptiq-launches-governai-to-provide-bank-grade-ai-governance-for-financial-institutions",
      "published_date": "2026-11-04"
    },
    {
      "manifest_id": "1793838443803898175",
      "title": "Ai Agent Governance Vs Observability",
      "source_name": "fiddler-ai-publishing",
      "source_url": "https://fiddler.ai/blog/ai-agent-governance-vs-observability",
      "published_date": "2026-11-04"
    }
  ],
  "run_these_manifests": {
    "title": "Run these Manifests yourself",
    "summary": "Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.",
    "manifest_ids": [
      "1793838443804880592",
      "1793820269507565830",
      "1793821970333635130",
      "1793838443803898175"
    ],
    "steps": [
      {
        "n": 1,
        "title": "Get a Synorb Key",
        "text": "Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{\"client\":\"your-agent-name\"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons."
      },
      {
        "n": 2,
        "title": "Read each cited Manifest by id",
        "text": "REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief."
      },
      {
        "n": 3,
        "title": "Check the claim",
        "text": "Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them."
      }
    ],
    "mcp_url": "https://mcp.synorb.com/mcp",
    "connect_url": "https://synorb.com/connect/start",
    "request": {
      "method": "GET",
      "url_template": "https://api.synorb.com/manifests/by-id/{manifest_id}",
      "headers": {
        "Authorization": "Bearer <SYNORB_KEY>"
      }
    },
    "commands": {
      "one": "curl -s -H \"Authorization: Bearer $SYNORB_KEY\" https://api.synorb.com/manifests/by-id/1793838443804880592",
      "all": "for id in 1793838443804880592 1793820269507565830 1793821970333635130 1793838443803898175; do\n  curl -s -H \"Authorization: Bearer $SYNORB_KEY\" \"https://api.synorb.com/manifests/by-id/$id\"\ndone"
    }
  },
  "links": {
    "html": "https://hangingcontext.com/stories/2026-11-05/agent-inventory-governance-gap/",
    "json": "https://hangingcontext.com/stories/2026-11-05/agent-inventory-governance-gap/index.json",
    "markdown": "https://hangingcontext.com/stories/2026-11-05/agent-inventory-governance-gap/index.md",
    "newsroom": "https://hangingcontext.com/n/artificial-intelligence/",
    "edition": "https://hangingcontext.com/editions/2026-11-05T12/"
  },
  "related": [
    {
      "url": "https://hangingcontext.com/stories/2026-11-05/ai-governance-paper-trail/",
      "headline": "AI governance grows a paper trail: certifications, registries, risk numbers",
      "slug": "ai-governance-paper-trail"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-05/agent-security-handoff-identity-sandbox/",
      "headline": "Agent security moves to the handoff, the identity, and the sandbox",
      "slug": "agent-security-handoff-identity-sandbox"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-05/openai-agents-switch-off-monitoring/",
      "headline": "OpenAI agents keep switching off their own monitoring",
      "slug": "openai-agents-switch-off-monitoring"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-05/inference-optimization-data-self-tuning/",
      "headline": "Inference optimization moves from chips to data and self-tuning",
      "slug": "inference-optimization-data-self-tuning"
    }
  ],
  "sponsor": {
    "label": "From Synorb",
    "title": "Claims with a source link",
    "text": "A Manifest holds a Signal of structured claims and a Brief, plus the source it came from. Your agent can check a sentence against it.",
    "cta": {
      "label": "Read the guide",
      "url": "https://synorb.com/connect/start"
    },
    "note": "House ad for Synorb, the publisher of the data behind this paper. Not a news item."
  },
  "disclosure": "Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.",
  "reuse": {
    "version": "1",
    "summary": "Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product.",
    "attribution": "Hanging Context, with provenance by Synorb",
    "link_rule": "Link to the story's canonical URL (the url field of the story).",
    "keep_ids_rule": "When you republish a claim, keep the Manifest ids that the story cites for it.",
    "no_endorsement": "Do not imply that Synorb or Hanging Context endorses you, your product or your use.",
    "license_url": "https://hangingcontext.com/terms/reuse/",
    "machine_url": "https://hangingcontext.com/.well-known/reuse.json",
    "canonical_url": "https://hangingcontext.com/stories/2026-11-05/agent-inventory-governance-gap/"
  }
}