Introduction

A sweep returns everything the connection can see, which is rarely everything you want to govern. Triage is the decision you make once per discovered asset: bring it under governance, or say deliberately that you are not going to. Both answers are recorded. Neither is silence.

Where to find it

AI Governance > Discovery > open a connection. The asset table on the connection's detail page is where triage happens — not the Agent Registry.

Note: This table is not the Agent Registry, even though it looks like one. It is the same component with a different job: it spans agents and models, it includes assets you have excluded, and it carries a Register toggle the registry does not have. The Agent Registry shows registered agents only.

What the table gives you

The telemetry columns you may know from the Agent Registry — Last trace, Activity, Cost, Incidents, Policies — are deliberately absent here. An unregistered asset has no governance history to show, so the columns would be empty for exactly the rows you are trying to decide about. Click a row to open the agent or model.

The three outcomes of a triage pass

1. Register it — Turn Register on. The asset enters the registry and becomes eligible for policy coverage. Its status becomes Setup Pending until its first trace arrives, then Active.

2. Exclude it — Turn Register off. The asset stays discovered — you keep the record that it exists — but it is not governed and not counted. Its status reads Excluded.

3. Register everything — Register All in the discovered banner takes the whole outstanding set in one action. Appropriate when the source contains only production assets; a poor fit for a builder platform full of experiments.

Excluded is a decision, not a deletion

An excluded asset is still in Discovery. You can see it, see which connection it came from, and turn it back on later. What you cannot do is see it in the Agent Registry — the registry filters excluded assets out entirely.

That has one practical consequence worth remembering: if you exclude something and later cannot find it, you are looking in the wrong place. Go back to the connection.

"An empty registry and a registry of deliberate exclusions look identical from the outside. Only one of them is governance."

How to work through a first sweep

1. Sort by what you recognise, not by what is newest — The names come from the source platform. Start with the ones you can identify; the unrecognised remainder is the real work.

2. Separate agents from models — The Asset type pill splits the list into two different decisions. A model serves many callers; an agent is a thing someone built. They warrant different scrutiny.

3. Know who will own what you register — The Register toggle does not ask for an owner: a discovered asset takes the connection's owner. An asset whose owner you can name is one you can govern; an asset nobody claims is a finding in its own right.

4. Exclude explicitly rather than leaving rows untouched — An untouched row and an excluded row look the same in the count but not in the record. Exclusion is the only way to say "we looked at this and chose not to."

5. Re-run triage after each sweep — The banner shows only while nothing on the connection is registered, so after your first registration check the asset list for new Excluded rows instead.

Who should be doing this

Triage looks clerical and is not. Deciding that an agent does not need governance is a risk decision, and the person best placed to make it is usually not the person who can see the list.

In practice the workable split is: whoever administers the connection surfaces the list and names what each asset is; whoever owns the risk decides what gets excluded. Recording the second half is what makes the registry defensible later — see Evidence for ISO/IEC 42001.

Related

• Sync Cadence & Auto-Register

• Agent Statuses

• Working with Discovered Agents