Centralised agent registry with continuous monitoring

Control objective

A centralised agent registry with continuous monitoring keeps an authoritative, up-to-date inventory of every AI agent operating in the bank, so none run unseen. 'Shadow agents' - those spun up outside governance, perhaps by a well-meaning team or by an attacker - are dangerous precisely because no one is watching them, and they bypass the identity, permission and oversight controls applied to sanctioned agents. To implement, require every agent to register before it can operate, capture its owner, purpose, identity and permissions in a single source of truth, continuously reconcile what is actually running against the registry, and run a recurring scan for unregistered agents, logging registry entries and scan results as evidence. No statistical metric applies; verification is inventory reconciliation. The threshold is that 100% of live agents are registered and that the weekly unregistered-agent scan returns zero findings. Any live agent missing from the registry, or any non-zero result from the weekly scan, is a breach that triggers investigation and either registration under governance or shutdown of the rogue agent, closing the visibility gap that shadow agents exploit.