The registry for every token-consuming Asset: its owner, its cost, and its risk.
Why now
Copilots, agents, batch jobs, Claude Code instances. Every team is adopting AI tools on their own timeline, and nobody has a central picture of what's running.
The blind spot
Framing from a Microsoft / Hypothesis Group survey of 1,725 security leaders, Feb 2026.
The risk
Each shadow agent potentially sends company data to a third-party API nobody vetted. In a world of SaaS vendor breaches, every unregistered AI tool widens the blast radius.
Prompts, context, and outputs flowing to APIs outside your security perimeter.
When a breach happens, you can't say which AI systems were in scope or what data they touched.
For us specifically: an unregistered agent touching student records is a FERPA/COPPA exposure at board level.
The cost
The other world
Introducing
| Asset | Framework | Owner | 30-day cost | Risk | State |
|---|---|---|---|---|---|
| i-Ready Tutor Assistant | claude-code | Data Eng | $4,210 | Tier 3 | production |
| Lesson Draft Generator | openclaw | Content | $1,980 | Tier 2 | production |
| Support Triage Bot | langgraph | Support | $640 | Tier 1 | development |
| Roster ETL Nightly | batch script | Platform | $305 | Tier 3 | production |
How it works
Anything that burns tokens goes in, regardless of framework or provider.
Each Asset sits under one Org Unit and pulls real spend from the provider.
Set a risk tier and clear approvals before anything reaches production.
Deployment
You receive a self-contained deployable. It runs on your infrastructure.
Your team runs the instance. No vendor access to your environment.
Reads aggregated usage — token counts, cost, timestamps. Never prompts, responses, or student PII.
Nothing leaves your network. No telemetry, no call-home, no external dependencies.
Turn it off any time. Nothing persists outside your environment.
Why not just use what we have
AgentRoster is the layer above those: the system of record for every AI Asset.
The ask
Where it goes
The registry is the foundation. Next comes per-invocation observability and policy that can stop an Asset before it ever reaches production. You start by seeing everything. Then you start deciding what's allowed.
Appendix · Architecture
Self-contained artifact. Runs on any Linux server or container runtime (Docker).
Anthropic, OpenAI, Azure. Read-only access to token counts, cost, timestamps.
Support via email/call only. No access to your instance or infrastructure.
Appendix · Data & security
Appendix · Provider scope
Claude Code, API calls, agents. Primary provider for the pilot.
Supported. Add after initial inventory is complete.
Credit-licensed, not direct token consumption. Out of scope.
Google, Cohere, Mistral, etc. Add as needed post-pilot.