Employees Are Quietly Building AI Agents. None of 20 Security Chiefs Could Count Them.

Picture an employee using a tool your IT department approved to set up a process that reads a shared inbox and updates your order and accounting system. If that employee is off, a potentially critical process stops working. Tal Carmi, chief information officer of the software company WalkMe, gave this example in CIO magazine. His point was that the employee has built an AI agent, software that acts on company systems by itself, without anyone calling it one. Repeat that across a large company and you can see how a bank might end up telling the security company RSA, as one did, that it officially had zero AI agents and, unofficially, 4,000. Several big software vendors now want to sell you a central register of every agent and what it is allowed to touch. Here is what that register does, why the vendor that keeps it can end up setting your company's rules, and whether you need one yet.

Greg Nelson, chief executive of RSA, recently asked a room of security chiefs from 20 of RSA's top enterprise customers if they knew how many AI agents were running inside their organisations. "Not one person could raise their hand," he said, according to the trade paper Computer Weekly. Agents like the one in Carmi's example don't require anyone to break a rule. "There's nothing shadowy about the process," Carmi wrote.

IBM and Salesforce call their version a control plane, and the analysts at Bain use the same term for Google's. In plain terms, it does two jobs: it is the personnel file for your agents and the security desk at the door. Each agent gets an entry in the register, along with a record of which systems and data it may use. Each time an agent tries to act, it goes past the desk, which checks its badge, lets it through or stops it, and writes the action down. Una Madigan Shortt, group chief data officer at Schneider Electric, reaches for the same comparison. On a security panel at the World Summit AI conference she said that if an agent is doing a full-time employee's work, "it should have an employee ID."

Who is selling it

Google showed its version at its cloud conference in April, with an agent identity that leaves "a clear, auditable trail for every action an agent takes" and a gateway to manage "your agent fleet from one control point." IBM followed in June. Its announcement promises "end-to-end visibility into what your agents are doing," with rules enforced "at runtime," meaning at the moment an agent tries to act, not in a report afterwards. Salesforce announced its version at Dreamforce, its annual conference, in September. C. Dunlap, a research director at the analyst firm GlobalData, wrote that it maintains a "central registry of all agents." At the end of September the OpenClaw Foundation released OpenClaw Enterprise as open-source code that companies run on their own servers; Quartz reported that it began as an internal project at OpenAI. The first modules of RSA's own product, Agent ID, are due on general sale on November 16.

One customer is Capita, the British outsourcing firm, which runs more than 350 agents through Salesforce's system, according to Salesforce's own blog. The same blog quotes Tiina Stephens, Capita's director of AI engineering: "You can't govern what you can't see."

Why it's hard to take out

A control plane only works if every agent goes through it, so over time it can end up holding your operating rules: which agent may refund a customer, up to what amount, on whose authority, and who gets called when it can't decide. If the bank ever turns its 4,000 unofficial agents into an official list, that list could become its rulebook for work nobody watches. The question is whose software that rulebook lives in.

The analysts at Info-Tech Research Group warn that the shared technical standards that let agents connect across vendors "do not guarantee semantic, policy, or configuration portability." Dependency, they write, can shift into "agent registries, business definitions, workflow logic, permission structures, evaluation records, and operational memory." The biggest vendors, Info-Tech notes, also start from what they already hold: Salesforce from customer records, Microsoft from staff logins, SAP and Oracle from transactions.

Nelson, who is selling one of these systems, puts the tension most sharply. "Without sovereign identity, it isn't really sovereign," he said. RSA lets customers run its checkpoint on their own machines or have RSA host it. Whatever you think of his product, he is right about where the leverage sits. If an outside supplier hosts your list of agents, it can end up holding a detailed written account of how your company is allowed to act.

Does a company that has barely got past assistants need one?

Mostly not yet. Gartner's 2026 survey of chief information officers and technology executives found that "only 17% of organizations have deployed AI agents to date," and Gartner adds that most deployments "remain narrowly scoped." Some of the products aren't finished either. Info-Tech says Salesforce's unified version starts rolling out early in Salesforce's fiscal 2028, which begins in February 2027, and should be read "more as Salesforce architectural direction." The OpenClaw Foundation suggests using its release for internal pilots. And Rens van Dongen, corporate AI officer at the Dutch national railway NS, said, as quoted by Computer Weekly, that most agents are "spun up and shut down again, sometimes within a minute or a day," so a formal register isn't always relevant.

Carmi's point cuts the other way, though. A company that thinks it only uses assistants may already have agents, built by staff with exactly the tools IT approved. The Wharton professor Ethan Mollick calls one way of working with AI "the conjurer": someone who summons agents, hands them work and judges what comes back. He warns that it "carries new risks as we lose control over what, exactly, the AI is doing." Nelson's test is the cheapest one available: "Ask your CISO how many agents you have running today." If your security chief can name them all, along with the person each one answers to, you don't need to buy anything yet. If not, the bank's two answers are your problem too.

What to ask a vendor pitching one

Can it find and control agents you didn't build with it? Info-Tech suggests asking whether outside agents "can be discovered automatically." If it only manages its maker's own agents, it is one more agent product, not a control plane.

Does it stop an action, or only record it? A system that blocks a payment over the limit is a control. A dashboard that tells you on Monday that the payment went out is a log.

If you leave, what comes with you? Ask for the list of agents, their permissions, the rules and the full history of their actions, in a form another system can read. If the answer is vague, your company's rules may end up living in someone else's product.