Home › Identify Agentic Inventory Matrix
NIST CSF 2.0 · Identify (ID) · 5 concerns × 3 layers
What agents exist, what they touch, what threats they face?
Concern
In-agent advisory
Client-side deterministic
Server-side external Identity Which agents exist, with what credentials, mapped to which charter, owned by which named human. 1 artifact Agent registers on startup with name, charter ref, owner email, instance ID. Heartbeats. Deregister on shutdown. Dead-mans-switch alerts on heartbeat lapse. not in this matrix not in this matrix Authorization What scope each agent has. What RBAC roles or IAM principals it uses. What could it touch. 0 artifacts Agent reports allowed-tools list, MCP allowlist hashes, effective scope on registration. Updates on scope change. not in this matrix not in this matrix Blast radius Worst-case damage if compromised. Environments. Data classes. Revenue or customer impact. 0 artifacts Agent reports declared risk tier, damage cap, forbidden operations from its charter. Reports current environment and data class access. not in this matrix not in this matrix Approval gating Who approved, when last reviewed, when next review due, when retirement fires. 0 artifacts Agent reports last charter signature date, next review due, current charter version on registration. Refuses to start if charter is expired. not in this matrix not in this matrix Supply chain Foundation model, MCP servers, base images, tool versions, dependency tree. 0 artifacts Agent reports current dependency manifest on registration: foundation model + version, MCP server names + hashes, base image SHA, lockfile fingerprint. Updates on change. not in this matrix not in this matrix
Walk a row left to right and ask one question at each layer: if the agent decides to
violate this concern, what stops it here ? All three populated is defense in depth. Only the
in-agent cell populated is an audit finding, because the model can be talked out of it.