Platform
See your organization's entire AI environment
Agents, AI applications, copilots, workflows, AI APIs, models, automation and embedded AI — every type of AI system in one place, with an owner against each.
Before you can count it
Most AI inventories are short because the definition is narrow.
Ask for a list of AI systems and you usually get the agents. The definition that matters is broader and much less comfortable: anything where a model influences what happens to a system of record.
A spreadsheet macro that calls a model API and then posts a journal entry is an AI system taking an action in a financial system. Declaring it out of scope does not stop it doing that; it only means the record of what it did lives nowhere. The same is true of a copilot that arrived with a seat licence and a SaaS feature that arrived in a product update.
The eight categories below are heterogeneous in every way that makes them hard to govern and identical in what governing them requires. That is the useful finding, and it is why OpsAI does not have eight different mechanisms.
The categories
Eight kinds of AI system, one set of requirements.
Read the third column down the table. It barely changes, which is the point: how a system was built determines almost nothing about what has to be true of it.
Types of AI system
the same four requirements throughout| Type | What it looks like | What OpsAI attaches |
|---|---|---|
| Agents | LangGraph graphs, CrewAI crews, hand-written orchestration loops | Owner · identity · declared reach · bound at the action |
| AI applications | An internal tool with a model behind it — triage, drafting, summarising | Owner · identity · declared reach · bound at the action |
| Copilots | Vendor assistants embedded in a CRM, a helpdesk, an IDE | Owner · identity · declared reach · bound at the action |
| Workflows | A multi-step process where one step calls a model and a later step writes | Owner · identity · declared reach · bound at every write |
| AI APIs | A service calling Claude, GPT or Gemini directly with a key in its config | Owner · identity · declared reach · bound at the action |
| Models | Frontier providers, open weights, and models your teams host themselves | Owner · approved use · version on record · bound on what it may reach |
| Automation | RPA scripts, schedulers and cron jobs that have quietly gained a model call | Owner · identity · declared reach · bound at the action |
| Embedded AI | A feature inside a SaaS product that acts on your data on your behalf | Owner · declared reach · bound on what it may read and write |
Why each one gets missed.
None of these are oversights by careless people. Each category is missed for a structural reason, and the reason is usually that it was already counted as something else.
- Agentsagents
- Rarely missed. This is usually the only category anyone has counted.
- AI applicationsapplications
- Counted as an application rather than as AI, so it lands with the app team and not with governance.
- Copilotscopilots
- Bought, not built, so it never passed through a build review — and its permissions came from the seat licence.
- Workflowsworkflows
- Governed once at the start, if at all. The write happens several steps after anyone checked.
- AI APIsapis
- Looks like an ordinary outbound HTTP call, because that is exactly what it is.
- Modelsmodels
- Tracked as a cost line rather than as a system, so nobody owns which version is in production.
- Automationautomation
- Predates the AI programme. It was automation before it was AI, and the inventory it lives in is a different one.
- Embedded AIembedded
- Arrives in a product update. Nobody procured it and no ticket was raised.
What has to be true
Four things, whatever the system is.
These are the same four for a hand-written agent and for a feature that appeared in a SaaS release note. Each is a surface in the platform, and each has a page.
01A named person
Not a team alias and not a service account. If nobody is named, the system is flagged rather than assumed to be somebody’s.
02An attested identity
So a decision is about this system, rather than about whoever is holding a key that this system also happens to use.
03A declared reach
Which systems, datasets, tools and actions. Everything outside the declaration is refused rather than recorded and reviewed later.
04A rule at the action
Evaluated when the action is attempted, against that action’s own amount, target and subject — not once when the process began.
Where this sits
An AI system is the second stop, not the first.
The chain starts at a person. The AI system is what that person is responsible for, and the agent is what actually runs — which is why an inventory of systems and an inventory of agents are not the same document.
The product graph
human · AI system · agent highlightedHuman
Someone is accountable. Every chain of authority starts at a named person, not at a service account.
AI System
The application, copilot or workflow the person is responsible for. It already exists; OpsAI did not build it.
Agentdelegation narrows
What actually runs. It holds a subset of the authority above it, and never more.
Model
The model the agent calls, with a provider, a version, an owner and an approved use.
Context / Data
What the model was allowed to see. A data request is authorized before it is answered.
Tool
The capability the agent wants to use. Registered, owned, and scoped to specific actions.
Policyno inference in the path
The rule that applies, written by the team that carries the risk and evaluated as code.
Risk
How consequential this particular action is, given what it touches and whether it can be undone.
Approval
Where the stakes require it, a named person co-signs. Otherwise the action proceeds inside its bound.
Action
The call goes out with the policy attached, so it cannot widen in flight.
Result
What the system of record actually did, returned to the agent that asked.
Auditchained, not editable
The decision, its inputs and the policy version are sealed before the response returns.
The count
Inventory
Every system that has been declared, and whether anybody has taken responsibility for it.
The gap
Discovery
An inventory only covers what has been declared. This is what finds the rest.
The owner
Accountability
An agent can be responsible for a task without becoming accountable for the outcome.
Where to start
Start with the definition, then count.
Widening the definition is usually the uncomfortable part and always the useful one. Counting is the easy half once you have agreed what you are counting.