An AI agent inventory needs permissions, not just model names

A list of AI model names is not an inventory of the systems using them. One model may sit behind many agents with different tools, identities and information sources. Microsoft’s 21 January posture-management account describes those layers as a connected attack surface. The same conversational interface can conceal very different access.

The account identifies models, platforms, tools, knowledge sources, guardrails and identities as parts of an agent. A useful review follows those relationships: which identity makes an action possible, what data the tool can retrieve and which other systems receive the result. Looking only at the model endpoint misses a document store shared too broadly or a tool operating with excessive privileges. Those exposures can exist before a malicious prompt appears.

Microsoft’s 20 January identity-security guidance argues for applying established access principles to AI and other non-human identities. It emphasises explicit verification, least privilege and planning for compromise. Giving an agent a named owner and a defined task makes those principles easier to assess. An inherited service credential with no clear owner creates a different review problem from a narrowly scoped identity assigned to one workflow.

The editorial implication is that the inventory is an operating record rather than a launch-day spreadsheet. Adding a connector, widening a group or changing a service identity can alter the risk without changing the model. Reviews should be triggered by those changes as well as by model upgrades. Microsoft’s reports describe its preferred security approach and product context; organisations still need to verify how those controls map to their own tools and responsibility boundaries.