Before You Need an Agent Control Plane, You Need an Agent Roster

The agent market is quietly admitting the boring part out loud: once agents can act, the first product is visibility.

That is the thread running through this week's announcements and warnings. OpenAI introduced workspace agents that can handle long-running workflows across tools and teams. Microsoft made Agent 365 generally available as a way to observe, govern, and secure agents. NVIDIA and ServiceNow described autonomous desktop agents that need policy-governed runtimes and workflow controls. JumpCloud published research saying agent deployment has outrun the controls needed to manage it safely.

Strip away the vendor language and the operating lesson is simple. The hard part is no longer getting an agent to do something impressive. The hard part is knowing which agent exists, who owns it, what job it is allowed to do, what systems it can touch, and how the business stops it when the work goes sideways.

Large companies are solving that with registries, control planes, identity systems, dashboards, approval flows, and runtime controls. Smaller teams usually do not need that full stack on day one. But they absolutely need the underlying operating truth.

They need an agent roster.

The market has moved past "can it do the task?"

OpenAI's workspace agents announcement is a clean marker for where the category is going. These are not just private chatbots. OpenAI describes shared agents that handle "complex tasks and long-running workflows" while operating inside organizational permissions and controls. The examples are ordinary business work: software request review, product feedback routing, weekly metrics reporting, lead outreach, and third-party risk management.

That matters because ordinary business work is where the risk becomes real. A weekly reporting agent is not dangerous because it can write a paragraph. It becomes consequential when it pulls numbers, creates charts, drafts the narrative, and delivers the report to people who may act on it. A lead outreach agent is not dangerous because it can write an email. It becomes consequential when it qualifies leads, drafts follow-ups, updates the CRM, and sits close to revenue.

The practical question changes as soon as the agent enters the workflow. It is no longer "Can this model reason?" It is "What work has this agent been assigned, and what authority does that assignment carry?"

That is where many teams get sloppy. They treat an agent like a clever tool when the business is actually creating a small worker with memory, access, triggers, and a pattern of action. If nobody writes down the worker's job, the business has created invisible labor. Invisible labor is hard to improve and harder to govern.

Enterprise vendors are giving away the clue

Microsoft's Agent 365 language is useful because it names the enterprise version of the problem. Microsoft says agents are already showing up across expected and unexpected places, and that they can span apps, endpoints, and cloud systems. The line worth keeping is the blunt one: "you can't govern what you can't see."

That is not only a security sentence. It is an operator sentence.

A business cannot improve an agent it cannot see. It cannot assign accountability for an agent it cannot name. It cannot decide whether an agent needs more access if nobody knows what access it already has. It cannot compare agent performance if every agent lives as a scattered shortcut, custom GPT, Slack bot, automation scenario, desktop assistant, or half-documented internal experiment.

Microsoft's May Agent 365 update points to the enterprise answer: "a single, authoritative system of record for agents." That system records details like agent name, description, publisher, platform, ownership, availability, deployment status, permissions, data access, tools access, security details, compliance details, and usage activity.

Most smaller businesses do not need to buy or build that entire control plane before they use AI well. But they do need a simpler version of the same object. A spreadsheet can be enough at the start. A page in the operating manual can be enough. A shared table in a project system can be enough.

The important thing is not the software. The important thing is that the agents become visible as operating assets instead of floating experiments.

A roster is not bureaucracy. It is how agents earn trust.

A useful agent roster is boring in exactly the right way. It says, in plain language, which agents exist and what each one is allowed to do.

For each agent, the roster should capture the name, owner, job, trigger, input sources, tools, permissions, outputs, review gate, stop rule, and current status. That is the minimum viable system of record. If a team cannot fill in those fields, the agent is not ready for broader access. It may still be worth testing, but it belongs in a sandbox or draft-only role until the job becomes clear.

This is not paperwork for its own sake. It is the difference between "we use AI" and "we have an agent that does this job, for this owner, with these boundaries, producing this product." That distinction is the whole game for teams that want agents that actually work.

The roster also stops a common form of agent drift. A team starts with a harmless helper. Then it adds a folder. Then a CRM connector. Then a Slack trigger. Then permission to send drafts. Then permission to update records. Each step feels reasonable in isolation. Six weeks later, the business has a semi-autonomous worker with no job card, no owner, and no clear stop condition.

The roster makes that drift visible before it becomes normal.

The stop rule belongs on the first page

JumpCloud's May 5 research summary sharpened the risk side of the market. It reported that 72% of organizations have agents in production, while 92% report serious limits in safely scaling deployments. The most useful public phrase for operators was not a big strategy claim. It was the "kill switch" gap: 55% of organizations lack a centralized kill switch to cut AI agent access across all systems.

A smaller business may not need a centralized enterprise kill switch on day one. But every agent needs a stop rule.

A stop rule answers a plain question: when does this agent stop acting and escalate to a human? The answer should be specific. Stop when confidence is low. Stop when the requested action touches money, legal language, payroll, medical claims, customer refunds, production systems, or outbound commitments. Stop when a source conflicts with another source. Stop when the agent has retried twice. Stop when the requested action falls outside the rostered job.

Without that rule, the team is trusting vibes. With that rule, the agent has an operating boundary.

This is where the agent roster becomes more than an inventory. It becomes a management tool. The owner can review which agents are draft-only, which are approved for recommendations, which are approved to update low-risk internal systems, and which are approved to take direct action under narrow conditions.

Authority stops being emotional. It becomes assigned.

The SMB answer is not "wait for enterprise governance"

The wrong lesson from enterprise agent governance is that smaller teams should freeze until they can afford a full control plane. That would be a waste. The market is moving too quickly, and many agents can create real value when their jobs are narrow and review gates are sane.

The better lesson is to start with legibility.

Before building the next agent, write down the agents already in play. Include the obvious ones and the informal ones. Custom GPTs, automations, scheduled prompts, Slack helpers, no-code workflows, research agents, coding agents, inbox agents, reporting agents, lead agents, support agents, and anything else that can act on work or shape a decision.

Then ask five questions:

1. What job does this agent actually do?
2. Who owns the agent?
3. What can it read?
4. What can it change?
5. What makes it stop?

Those five questions will reveal most of the risk and most of the opportunity. Some agents will be retired because nobody owns them. Some will be narrowed because they can touch too much. Some will be promoted because they are already useful and only need a clearer review path. Some will become templates for better agents.

That is how agent adoption becomes an operating capability instead of a pile of disconnected experiments.

The agent roster is the first grown-up artifact

AI agents are becoming a new layer of work. They are not just content tools, search tools, or novelty demos. They are beginning to sit inside workflows, gather context, make decisions, call tools, and hand work back to people.

That shift requires a grown-up artifact. Not a 60-page governance policy. Not a procurement committee. Not a vague AI strategy deck. The first grown-up artifact is a roster.

Name the agents. Name the jobs. Name the owners. Name the tools. Name the permissions. Name the stop rules.

Once that exists, better decisions become possible. The team can decide where to add access, where to remove access, where to require approval, where to measure output, and where to build next. The agent program stops depending on enthusiasm and starts depending on visible operating facts.

That is the practical middle path. Do not wait for perfect enterprise governance. Do not hand every impressive agent the keys. Make the work visible, then make the agent stronger.

Sources

• OpenAI, "Introducing workspace agents in ChatGPT," April 22, 2026: https://openai.com/index/introducing-workspace-agents-in-chatgpt/
• Microsoft Security Blog, "Microsoft Agent 365, now generally available, expands capabilities and integrations," May 1, 2026: https://www.microsoft.com/en-us/security/blog/2026/05/01/microsoft-agent-365-now-generally-available-expands-capabilities-and-integrations/
• Microsoft Community Hub, "What's New in Agent 365: May 2026," May 1, 2026: https://techcommunity.microsoft.com/blog/agent-365-blog/what%e2%80%99s-new-in-agent-365-may-2026/4516340
• NVIDIA Blog, "NVIDIA and ServiceNow Partner on New Autonomous AI Agents for Enterprises," May 5, 2026: https://blogs.nvidia.com/blog/servicenow-autonomous-ai-agents-enterprises/
• PR Newswire / JumpCloud, "JumpCloud Research Reveals AI Agents are Operating Without Governance in Critical Workflows," May 5, 2026: https://www.prnewswire.com/news-releases/jumpcloud-research-reveals-ai-agents-are-operating-without-governance-in-critical-workflows-302762798.html

Stephen Nickerson.
Built for operators who need agents they can test, trust, and improve.