Part of the AI Security Architecture series, following Forensic Readiness for Agentic AI and The Agent Registry Problem
Two responses/comments to my post on the Agent Registry post deserve a direct answer because they articulate exactly the gap this series is designed to close. Thank you to the commenters for raising these points.
The first comment:
“You cannot govern an estate you cannot see. As agents become more capable, an inventory must go beyond a name and owner. It needs the agent’s purpose, access scope, knowledge sources, operating environment, approval path and evidence trail. Otherwise agent sprawl becomes the AI equivalent of unmanaged shadow systems.” – Brian Stack
The second comment:
“The registry is the right start, but it only captures what you can enumerate. The agents that create exposure are the ones that never register: the browser tab or IDE plugin spun up this morning. Visibility that survives an audit has to live at the point of action — every prompt and tool call.” – Groovy Security
Both are correct and both identify the same architectural truth:
A registry is necessary but insufficient.
The Registry’s Deliberate Limitation
The Agent Registry post made a scoped claim: you cannot govern what you cannot see. An inventory of agents (who owns them, what they access, what authority they hold) is the prerequisite for everything else. Without it, forensic readiness, compliance reporting and incident response all fail silently.
A registry is a passive control, recording what exists and not constraining what agents do. It does not verify the integrity of their components nor does it prove that runtime behaviour matched authorised intent. As the second comment rightly observes, it cannot capture agents that never register.
A registry solves the visibility problem. It does not solve the enforcement problem, the trust problem or the provenance problem.
The Governance Tetrad
This series is building toward an architectural pattern I am going to call the Governance Tetrad four interlocking disciplines that together close the loop on AI agent governance.
A tetrad is simply a group or set of four related things. From Greek tetras (τετράς) meaning “four”
| Discipline | Question It Answers | Control Type |
|---|---|---|
| Agent Registry | Which agents exist and what are they permitted to do? | Passive inventory |
| Output Assurance | Did this agent stay within its authorised boundaries at runtime? | Active enforcement |
| Supply Chain Integrity | Can we trust the components from which the agent was assembled? | Provenance verification |
| Architecture Decision Records | Why was this system designed this way, and can we prove it to an auditor? | Decision provenance |
Each discipline is necessary. None is sufficient alone and they are designed to be mutually reinforcing:
- The registry tells you the agent exists. Output Assurance proves it stayed within its authority, at the point of action, on every prompt and tool call. This is enforcement that does not depend on registration, because the proof travels with the action and not in a separate inventory.
- The registry documents which tools and data sources an agent may access. Supply Chain Integrity verifies that those tools, models, libraries and knowledge bases are themselves trustworthy. You cannot assure the output of a system whose inputs you do not trust.
- The registry records purpose, scope and approval path. Architecture Decision Records capture why those boundaries were set, what alternatives were considered and what regulatory obligations they satisfy. When a regulator asks “why was this agent given autonomous authority over financial transactions?”, the ADR can provide the answer if it is documented well.
What Comes Next
The next three posts to be published in this series address, in order:
- Output Assurance: how to ensure that what an agent actually does stays within the boundaries of what it was authorised to do. Enforcement at the point of action, not the point of registration.
- AI Supply Chain Integrity: the discipline of ensuring that every model, dataset, library, tool definition, retrieval corpus and prompt template has known provenance, verified integrity and documented lineage.
- Architecture Decision Records for AI: why ADRs are the missing governance layer and how they create the decision provenance that connects policy intent to technical reality.
The Architectural Principle
A registry that captures only name and owner is a spreadsheet. A registry embedded within a governance tetrad (where enforcement lives at runtime, trust is verified at assembly and decisions are recorded at design time) is architecture.
The comments are right. A registry is not enough. It was never meant to be. It is the first corner of a four sided structure. The remaining three sides are what make it load bearing.
Leave a Reply