Agent Sprawl & Shadow-Agent Detection
Maintain a canonical inventory of all deployed agents and detect shadow, orphaned, or duplicate agents in the portfolio.
This page is the complete instruction page for one pattern called "Agent Sprawl & Shadow-Agent Detection." It explains the problem this pattern solves, the idea behind the solution, when you should (and should not) use it, and what happens afterward, both the good effects and the costs.
This matters because building AI agents is not just about making them clever. It is also about making them safe and predictable. Following a well-tested pattern like this one helps avoid common mistakes, and shows you exactly which safety rules and regulations it connects to, listed under "Standards Mesh" on this page.
Context
As agent deployments proliferate, enterprises accumulate: duplicates (multiple teams solving the same problem), shadow agents (deployed without review), orphaned agents (owner left the company), and permission creep. The AAGMM paper documents these as the five sprawl patterns.
Problem
Uninventoried agents cannot be governed, secured, or safely decommissioned.
Forces
- Discovery overhead vs portfolio health
- Tool-driven discovery vs voluntary registration
Solution
Central registry of agents with mandatory metadata: owner, purpose, autonomy tier, data access, upstream/downstream dependencies, last review. Passive discovery via IAM, gateway, and observability signals catches shadow agents. Periodic review catches orphans and duplicates.
Where this pattern acts in the two lifecycles
06 Reflect / Learn. Critique, self-correct, memory write. 8 of 61 catalogue patterns act at this stage.
05 Operate & Monitor. Runtime telemetry, drift detection. 18 of 61 catalogue patterns act at this stage.
Stages and counts from the catalogue data. The Runtime lens is the loop the agent runs each turn; the AgentOps lens is the lifecycle the team runs the agent through. See the Matrix for every pattern at each stage.
Applicability
- Enterprise agent portfolios
- Organisations past ~10 agents
- Any regulated deployment
Anti-Patterns
- "Every team runs their own agents"
- Registry that depends only on voluntary registration
Consequences
- +Portfolio visibility
- +Basis for rationalisation
- −Registry maintenance
- −Political friction around consolidation
