Managing AI Agents in AI Governance

Overview

An AI Agent in AI Governance is an inventory object used to represent a runtime orchestration component that performs tasks using models, data, tools, or workflow logic.

AI Agents are commonly found in agentic and compound AI architectures, including:

Conversational assistants that retrieve information or call tools
Automation agents that execute multi‑step workflows
Orchestration layers coordinating multiple models or agents
Analytical or monitoring agents operating semi‑autonomously

The AI Agent inventory object helps organizations understand, document, and govern agent behavior as it operates in production environments, while keeping clear separation between business intent, operational systems, and technical components.

Technical Enablement Video

When should I use the AI Agent object?

Use the AI Agent object when you need to represent:

A runtime component that orchestrates tasks, rather than producing a single static output
An AI capability with instructions, autonomy, memory, or tool access
Agentic workflows involving planning, reasoning, or coordination
AI artifacts discovered automatically through supported cloud or platform integrations

You may not need an AI Agent if:

The AI capability consists of a single predictive or generative model with no orchestration layer
The system behaves like a traditional ML service without task execution or tool calling

AI Agents in AI Governance Inventories

AI Governance distinguishes between business context, operational capability, and technical components. In the recommended baseline model:

Project: business initiative or use case
AI System: deployed AI‑enabled application or capability
AI Agent, Model, Dataset: technical runtime components

AI Agents are generally treated as technical components, even though some customer architectures may be agent‑first.

Important:

The platform does not enforce a strict hierarchy. AI Agents can exist independently, but are often easier to govern when linked to an AI System or Project.

Creating AI Agents

The recommended method for creating AI Agent inventory records is through AI Automations. AI Automations automatically scan supported cloud environments, APIs, pipelines, and applications to detect deployed AI agents, models, and datasets. When an agent is discovered, OneTrust automatically creates or updates the corresponding AI Agent inventory record.

Automation‑discovered agent records may include:

Agent identifiers and aliases
Hosting provider and deployment region
Model bindings and data sources
Operational status and lifecycle metadata
Source system and automation provenance

This approach helps organizations:

Maintain a continuously up‑to‑date AI Agent inventory
Reduce reliance on manual self‑reporting
Improve auditability and traceability
Support scalable governance across environments

Note:

AI Automations are deployed using a lightweight worker node, designed for simplified setup and minimal operational overhead. For setup instructions, see AI Automation Feature Guide

Manual creation (optional)

Manual creation is supported, but should be considered secondary to automation‑based discovery. You may choose to create an AI Agent manually when:

Documenting an agent before deployment
Modeling a planned or conceptual architecture
Adding context not available from automated discovery

On the AI Governance menu, select Inventory > AI agents. The AI agents screen appears.
Click the Add agent button. The Create new modal appears.
Provide a unique name and choose the appropriate organization level. The Organization field will default to the current level.
Click Show More Details to enter additional details and context for the agent using the provided system attribute, including:
- Agent type and autonomy level
- Instructions, tools, and resources
- Intended audience or operational status
Note:
To learn how to add custom attributes so they appear in this modal as available fields, see Managing Attributes for AI Governance.
(Optional) Link the agent to related inventory records (AI Systems, Models, Datasets, Assets).
Click the Save button. The Inventory details screen appears. The new project will also be added to the Agents list screen.
The inventory will be created using the assigned default workflow. To change the default option, see Creating & Managing AI Governance Workflows.

Automation vs Manual creation


Aspect	AI Automations (Recommended)	Manual Creation
Primary use	Discover deployed agents in real environments	Model planned or conceptual agents
Data freshness	Continuous, sync-based updates	Sync unless manually updated
Scale	Designed for multi-environment enterprise use	Best for limited or early-stage use
Provenance	Includes source system and automation metadata	User-entered
Effort	Low, ongoing effort after setup	Higher manual effort over time
Governance role	System of record for technical artifacts	Supplementary

To manage AI Agent inventory details & workflows

On the AI Governance menu, select Inventory > AI agents.

The AI agents screen appears.
Click on the name of an agent.

The Inventory Details screen appears with the Details tab open by default.
In the Details tab, update the agent's details or actions as necessary. This may include:
- Add or modify relationships to Models, Datasets, Assets, or AI Systems
- Advance or revert workflow stages
- Track updates over time for audit and oversight purposes
Tip:
AI Agent records are often updated more frequently than business‑context records, reflecting the iterative nature of agent development and deployment.
Click the Save button to retain your changes.

To delete an AI Agent inventory

On the AI Governance menu, select Inventory > AI agents.

The Agents screen appears.
Hover over the row of an agent record to reveal and click the Context Menu icon.
Select Delete.

The Delete Record modal appears.
Click the Confirm button. The agent will be removed.

Important:
Deleting an inventory record does not affect the underlying agent or platform.

FAQ

What is the difference between an AI Agent and an AI System?

An AI System represents the operational AI capability or application delivered to users or downstream systems. An AI Agent represents a runtime component that performs tasks within that system.

In simple terms:

AI System = what the business deploys
AI Agent = how work gets done at runtime

Can an AI Agent exist without an AI System?

Yes. The current product supports AI Agents as standalone records. However, for most customer implementations, it is clearer to treat agents as components of an AI System, unless the architecture is explicitly agent‑first.

Should every AI System have an AI Agent?

No. Many AI Systems, especially traditional predictive or rules‑based systems, do not require an agent layer. Only create AI Agent records when there is meaningful orchestration, autonomy, or tool‑enabled behavior to govern.

Where should assessments attach for agentic AI?

Assessments can attach to multiple inventory types.

Projects: assess the use case or initiative
AI Systems: assess the deployed capability
Models or AI Agents: assess technical or behavioral risk

What policies evaluate for AI Agents?

Today, policies can evaluate attributes and metadata on AI Agent records, including seeded and custom fields populated manually or through automation. Policy support for richer runtime or evaluation‑driven signals is expected to expand over time.