Scan and connect to get complete visibility, and start acting. Connect your platforms, clouds and agent environments. Scan continuously for agents, AI functions and embedded cognitive capabilities, including agent-to-agent connections and shadow agents. Done when every environment is connected, new agents surface automatically and no one can name an agent the scan hasn't found.
Assign a named, accountable owner to each agent. Ownership enforced in the registry, not a spreadsheet. Duplicates and orphans resolved. Done when every agent answers “who is responsible for you?”
Give every agent its own identity. Agents are workloads, not humans. No shared or inherited human credentials. Least privilege access. Done when no agent acts under a person's login.
Classify each agent by autonomy level and data sensitivity. Use the two dimensions together to tier risk. Done when every agent has a risk tier that determines its controls.
Define the global contract, your fleet's code of conduct. The baseline rules every agent inherits, regardless of function or platform. Done when a new agent is born governed by default.
Specialize contracts by function, risk and operating context. Layer machine-readable controls, rules plus intent, on top of the baseline, connected to the classifications and policies you already manage. Done when contracts update when governance context changes, not when someone remembers.