Someone at your company has been asked how many AI agents you are running.
They cannot answer it. Not because nobody looked, but because “agent” turns out to mean three completely different things, and only one of them is yours.
Here is the test. Pick any agent someone names and ask one question:
Who issued its credentials?
That sorts it into one of three piles. The piles have almost nothing to do with each other, and mixing them together is why the count never lands.
1. You issued them
A nightly job that reconciles inventory. Someone wrote it a role in Terraform, and a second person reviewed it.
Now there is a model in the loop, so people call it an agent. Nothing else changed. Your account issued the identity. Your team wrote the permissions. Every call it makes shows up in your own logs.
This is the boring pile, and the boring pile is the one with answers:
- You can list them.
- You can read what each one is allowed to do.
- You can see what it actually did.
- You can delete one this afternoon and know by tomorrow what broke.
All four of those are true. Hold onto the last one, because it is doing more work than it looks like it is.
2. Someone else’s software brought them
Your document tool ships an assistant that answers questions by reading across every file in the workspace.
Nobody on your team built it. It showed up in a release note.
It runs on the vendor’s servers, under the vendor’s identity, and it reaches your data through a permission an admin granted once. Probably by clicking through a consent screen. Possibly by leaving a default switched on.
You cannot list these. You can only list the permissions you granted, and that is not the same thing. “Read files in this workspace” does not tell you whether one assistant uses it or forty, whether the vendor added another one last Tuesday, or what any of them did once they were in.
Your only real lever is that consent, and consent is usually all or nothing. Keep the integration and its access, or rip it out and lose the feature a whole department asked for. Nobody who has tried to revoke half an OAuth scope mid-quarter would call that control.
You fix this pile through contracts and procurement, not through your cloud console.
3. Nobody issued them
A coding assistant on an engineer’s laptop, running on a personal access token they minted from their own account and pasted into a config file. Scoped generously, because scoping it properly would have taken twenty minutes and the work was due.
There is nothing to revoke here, because nothing was ever issued. What exists is a credential that works, belonging to a human whose access was sized for a human working at human speed.
When that person leaves, offboarding closes their accounts. It does not know about the token in a config file on a laptop that has already been wiped, or the copy in a personal repository, or the small script a teammate now quietly depends on.
This is the pile that keeps people up at night, and it is the one you can least count by asking. Surveying engineers about which assistants they run measures memory and honesty, not credentials.
So why does the big number keep coming up?
Because of forecasts like this one:
By 2028 an average global Fortune 500 enterprise will have over 150,000 agents in use, up from less than 15 in 2025.
Gartner Press Release, Gartner Identifies Six Steps to Manage AI Agent Sprawl, 28 April 2026.
The forecast is not the problem. The question people attach to it is.
Suppose you did the counting and came back with one big number. What would you actually do with it?
Headcount for managing identities in your own accounts comes out of pile one. How hard you push on vendor review is pile two. Secret scanning, shorter token lifetimes, and making the approved path fast enough that nobody works around it is all pile three.
Three piles, three owners: your platform team, whoever signs the contracts, and for the third one, quite often nobody.
“150,000 agents” cannot be handed to anyone, because its three parts come out of three different budgets and get fixed by three different groups of people.
Ask the smaller question instead
Not “how many agents do we have.”
How many agents are using credentials we issued?
That one you can answer from records you already keep. It is also the only pile where you can see behaviour rather than paperwork: what the thing actually did, not what somebody once agreed it could do.
The fair objection
This is convenient, is it not. Draw a circle around the easy pile, call the rest someone else’s job, go home.
Worth answering directly: piles two and three matter. Three is probably where your worst single incident comes from.
But neither gets better by counting. Pile two improves when consent is negotiated narrowly and renegotiated at renewal. Pile three improves when the reason to mint a personal token goes away, which usually means the sanctioned path was slower than the shortcut. Neither of those starts with a census.
The count was never the hard part
Back to that last bullet in pile one.
You can list those identities today, and most teams already have. Somewhere in your organisation there is a spreadsheet of service accounts with a “last used” column, and it has been accurate and ignored for eighteen months.
The list is not what is missing. What stops anyone deleting a row from it is the question the list cannot answer:
If I take this permission away, what stops working?
An inventory can tell you a permission has not been used in ninety days. It cannot tell you whether the job that needs it runs quarterly. It cannot tell you that two services share the identity and only one of them went quiet. Unused and safe to remove are not the same thing, and everything expensive lives in the gap between them.
That is why the pile you own is fully catalogued and completely untouched. Not because nobody counted. Because counting was never the part that was hard.