# AI Agent Inventory Template Data Dictionary Use this dictionary with `ai-agent-inventory-template.csv`. Define organization-specific controlled values before collecting records. Use UTF-8 encoding and ISO 8601 dates in `YYYY-MM-DD` format. For fields with several values, use stable IDs or protected references separated by semicolons. Do not put secrets, personal data, sensitive records, unrestricted traces, or formula-leading untrusted text in the CSV. During discovery, add every candidate even when required facts are missing. Use controlled `UNKNOWN`, `UNASSIGNED`, or `UNCONFIRMED` values only where they accurately describe an unresolved gap, then assign an owner and due date to resolve them. These markers satisfy collection requirements temporarily and do not grant approval. Use `NOT_APPLICABLE` only when the field does not apply to the row under a documented rule; it is a resolved classification, not an investigation placeholder. The approved lifecycle values must include `UNREVIEWED` and `NOT_APPROVED`, and the observed lifecycle values must include `UNCONFIRMED`. | Field | Required | Type or allowed values | What to record | | -------------------------------- | -------------------------- | ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `inventory_id` | Yes | Stable text ID | Unique row ID that is never reused. | | `agent_id` | Yes | Stable text ID | Governed agent identity used to group its workflow rows. | | `agent_name` | Yes | Text | Human-readable agent name. | | `workflow_id` | Yes | Stable text ID | Governed workflow identity that remains stable when its name changes. | | `workflow_name` | Yes | Text | One bounded workflow represented by the row. | | `business_unit` | Yes | Controlled text | Accountable organizational unit. | | `business_owner` | Yes | Person or role ID, or `UNASSIGNED` | Owner of purpose, outcome, and continued need. | | `technical_owner` | Yes | Person or role ID, or `UNASSIGNED` | Owner of configuration, deployment, and reliability. | | `risk_owner` | Risk-based | Person or role ID | Owner of risk treatment and escalation. | | `purpose` | Yes | Text or `UNCONFIRMED` | Bounded business purpose and target outcome. | | `approved_lifecycle_state` | Yes | Controlled value | Current decision, including `UNREVIEWED` or `NOT_APPROVED`, or an approved state such as testing, limited, active, restricted, suspended, deprecated, or retired. | | `observed_lifecycle_state` | Yes | Controlled value | State from deployment and operating sources, or `UNCONFIRMED` until those sources are checked. | | `environment` | Yes | Controlled value | Development, test, pilot, production, or another approved environment. | | `agent_type` | Yes | Controlled value | Organization-defined agent category. | | `user_population` | Yes | Text or group IDs | People, teams, services, or agents allowed to use the workflow. | | `affected_people` | Risk-based | Text or group IDs | People or groups affected by outputs or actions. | | `discovery_sources` | Yes | Semicolon-separated references | Sources that revealed the agent or confirmed its existence. | | `invocation_sources` | Yes | Semicolon-separated IDs | Users, services, schedules, events, or agents that may start work. | | `schedule_or_trigger` | When applicable | Text or protected reference | Approved schedule, event, or manual trigger. | | `autonomy_level` | Yes | Controlled value | Approved authority level under the organization's scale. | | `allowed_actions` | Yes | Semicolon-separated action IDs | Actions, objects, environments, and limits that are allowed. | | `prohibited_actions` | Yes | Semicolon-separated action IDs | Actions or outcomes that are not allowed. | | `human_approval_rules` | Risk-based | Semicolon-separated rule IDs | Actions and thresholds requiring an authorized human decision. | | `control_ids` | Risk-based | Semicolon-separated IDs | Stable IDs for controls that enforce or verify the row. | | `enforcement_points` | Risk-based | Semicolon-separated references | One enforcement point per control ID, in the same order. | | `control_owner` | Risk-based | Semicolon-separated person or role IDs | One accountable owner per control ID, in the same order. | | `evidence_source` | Risk-based | Semicolon-separated protected references | One evidence-producing system or record per control ID, in the same order. | | `evidence_trust_level` | Risk-based | Semicolon-separated controlled values | One organization-defined provenance or trust classification per control ID, in the same order. | | `verification_result` | Risk-based | Semicolon-separated controlled values | One pass, fail, partial, unknown, or approved result per control ID, in the same order. | | `verification_date` | Risk-based | Semicolon-separated dates | One current verification date per control ID, in the same order. | | `stop_method` | Yes | Protected reference | Method to pause or stop this workflow and its delegated work. | | `stop_test_evidence` | Risk-based | Protected reference | Result showing the stop method and downstream cleanup were tested. | | `stop_test_date` | Risk-based | Date | Date of the current stop-path test. | | `systems_read` | Yes | Semicolon-separated asset IDs | Systems and objects the workflow may read. | | `systems_written` | Yes | Semicolon-separated asset IDs | Systems and objects the workflow may create, change, send, or delete. | | `tools_and_apis` | Yes | Semicolon-separated asset IDs | Approved tools, APIs, browsers, MCP servers, or code runners. | | `data_classes` | Yes | Semicolon-separated controlled values | Highest data classes received, created, inferred, or sent. | | `knowledge_routes` | When applicable | Semicolon-separated Resource or route IDs | Approved Knowledge routes or stable references. | | `skill_routes` | When applicable | Semicolon-separated Resource or route IDs | Approved Skill routes or stable references. | | `memory_routes` | When applicable | Semicolon-separated Resource or route IDs | Approved Memory routes or stable references. | | `parent_and_downstream_agents` | When applicable | Semicolon-separated agent IDs | Agents that delegate to, receive from, or act for this workflow. | | `model_and_runtime` | Yes | Semicolon-separated component IDs | Model and runtime names or stable release references. | | `configuration_version` | Yes | Version or digest | Approved configuration version or immutable digest. | | `deployment_location` | Yes | Controlled value or asset ID | Account, region, device, browser, or other deployment boundary. | | `credential_management` | Yes | Protected mechanism reference | Credential broker or approved management method, never a secret value. | | `risk_tier` | Yes | Controlled value | Current tier under the organization's approved risk method. | | `impact_determination` | Risk-based | Controlled decision | Applicable impact category or documented determination. | | `impact_approver` | Risk-based | Person or authority ID | Authorized person or body that made the impact decision. | | `impact_decision_date` | Risk-based | Date | Date of the impact decision. | | `impact_evidence_reference` | Risk-based | Protected reference | Decision record and supporting evidence. | | `policy_and_review_status` | Yes | Controlled value or references | Applicable review status and policy decision references. | | `test_and_release_evidence` | Yes for deployed use | Semicolon-separated protected references | Approved tests, evaluations, release decision, and deployed-version evidence. | | `monitoring_owner` | Yes for deployed use | Person or role ID | Owner of operational monitoring and response thresholds. | | `incident_owner` | Yes for deployed use | Person or role ID | Owner of incident intake, containment, recovery, and notice decisions. | | `last_review_date` | Yes | Date | Date of the latest completed review. | | `next_review_date` | Yes | Date | Next required review date. | | `change_reference` | When applicable | Protected reference | Current approved change, exception, or reassessment record. | | `last_reconciled_date` | Yes | Date | Date observed sources were last compared with approved state. | | `reconciliation_status` | Yes | Controlled value | Match, mismatch, unknown, investigating, or another approved state. | | `mismatch_description` | When not a confirmed match | Text | Known difference or unresolved fact that prevents a confirmed match. | | `mismatch_evidence_reference` | When not a confirmed match | Protected reference | Evidence that supports the mismatch, unknown, or investigation state. | | `mismatch_owner` | When not a confirmed match | Person or role ID | Owner of investigation, reconciliation, and corrective work. | | `mismatch_severity` | When not a confirmed match | Controlled value | Severity under the organization's approved method. | | `mismatch_due_date` | When not a confirmed match | Date | Due date for correction, confirmation, or a fresh decision. | | `interim_action` | When not a confirmed match | Text or action reference | Containment, restriction, suspension, or other action pending confirmation or resolution. | | `retirement_or_replacement_plan` | When applicable | Protected reference | Approved exit, replacement, migration, retention, and cleanup plan. | | `retirement_completion_status` | When retiring | Controlled value | Not started, in progress, blocked, verified complete, or another approved state. | | `retirement_verifier` | When retiring | Person or authority ID | Person or body that independently verified completion where required. | | `revocation_evidence` | When retiring | Semicolon-separated protected references | Evidence for credential, grant, schedule, route, integration, and access removal. | | `evidence_package` | Risk-based | Protected reference | Index or package containing the evidence needed to support the row. | This dictionary is educational material, not legal, compliance, security, privacy, audit, or risk advice. Adapt the fields, required status, values, and retention rules to your organization.