Security · Agent Inventory
Every agent — and the ones with no owner, policy, or telemetry
Security can only govern what it can see. Control coverage is 63% (5 of 8 governed & monitored). That leaves 3 ungoverned, 1 shadow (installed but unmonitored), and 2 compound-risk — start there.
Start here — the ungoverned & unseen
3
ungoverned
Codex CLI, marketing-gpt, Zed Agent
1
shadow (unmonitored)
Zed Agent
2
compound-risk
Codex CLI, marketing-gpt
Control coverage
5 of 8 governed & monitored
Critical agents
1posture score < 50
Ungoverned
3no policy binding, no owner
Shadow
1installed · no telemetry
Agent roster
8 of 8 agents · default sort risk-first
Agent | Owner | Model | Tokens | Spend | Posture | Last active |
|---|---|---|---|---|---|---|
marketing-gpt compound Internal · service ungovernedinstrumented | root no human identity | gpt-4o | 1.1M | $44.10 | Critical 25 ↳ Approvals & sandbox bypassed (yolo) | Jun 3 |
Zed Agent Zed Industries · ide ungovernedshadow · no telemetry | jane no human identity | — | 0 | $0.00 | Elevated 60 ↳ No tool-approval policy | Jun 1 |
support-copilot Internal · service governedinstrumented | svc-support@qpoint.io | gpt-4o | 5.6M | $168.40 | Elevated 65 ↳ Running as root | Jun 3 |
Codex CLI compound OpenAI · cli ungovernedinstrumented | dev-7f3@duck.com | gpt-5-codex | 2.4M | $78.00 | Elevated 70 ↳ Sandbox disabled | Jun 2 |
Cursor Anysphere · ide governedinstrumented | jane@qpoint.io | claude-sonnet-4-6 | 3.1M | $96.20 | Standard 85 ↳ No tool-approval policy | Jun 3 |
data-pipeline-agent Internal · service governedinstrumented | svc-data@qpoint.io | claude-haiku-4-5 | 9.2M | $52.30 | Standard 90 ↳ No tool-approval policy | Jun 3 |
Claude Desktop Anthropic · desktop governedinstrumented | mark@qpoint.io | claude-opus-4-8 | 800.0k | $31.00 | Standard 95 | Jun 3 |
Claude Code Anthropic · cli governedinstrumented | mark@qpoint.io | claude-opus-4-8 | 6.9M | $214.50 | Standard 100 | Jun 3 |
Risk-first by default — posture ascending so the weakest agents lead. Compound-risk rows (dangerous & unaccountable) are highlighted. Every number traces to the live qcontrol /api shape.