BlueprintPage 14
14CORE PRODUCT
Agent Discovery
A first-day discovery report should reveal unknown agents, overprivileged identities and unused credentials before enforcement is enabled.
- Priority
- P0
- Phase
- MVP
- Primary owner
- Platform / Integrations
- Status
- Blueprint
Objective
Discovery is the entry point because enterprises cannot govern agents they do not know exist. The engine should combine API enumeration, cloud metadata, identity/service-account analysis, source-code/config scanning and observed runtime traffic to identify both sanctioned and shadow agents.
What to build
- Discover agents from model platforms, agent frameworks, cloud services, identity systems, source repositories and gateways.
- Identify MCP servers, tool registries, service accounts, API credentials and applications associated with each agent.
- Classify discovered objects as confirmed agent, probable agent, supporting workload or unknown.
- Correlate duplicates across providers and environments into one logical agent record.
Implementation decisions
- Build connector-specific evidence rules rather than labeling every service account as an agent.
- Maintain confidence score and reasons for each discovery classification.
- Support scheduled scans plus streaming updates/webhooks where providers offer them.
- Allow customers to suppress known false positives without deleting raw evidence.
Definition of done
- A new supported agent appears in inventory within the defined discovery SLA.
- Every discovered agent has source evidence and confidence metadata.
- Unowned and stale agents can be filtered and exported for remediation.
Success metrics
- Agents discovered
- Shadow/unowned percentage
- Discovery precision
- Mean time from creation to detection
LANDING FEATURE
A first-day discovery report should reveal unknown agents, overprivileged identities and unused credentials before enforcement is enabled.