c16
c16 / wf5.m1 - Agent Control Plane — hi-fi (wf5.m1) / Teams Users·control-plane-v1/teams-users·draft

Identity & Access · Teams & Users

7 owners stand behind 8 agents — 3 answer to no one

A problem with no owner is just a shrug. 7 distinct owners stand behind the 8-agent fleet, but 3 agents answer to no one — a vendor alias (duck.com) or a proxy-only agent with no human behind it. $290.50 of at-risk spend traces to a named owner you could budget or hold responsible; the rest lands on nobody. Owner is observed; team is projected until the directory join.

Rolled up from agents by owner (email || user) — ranked by risk weight first, then at-risk spend.

Distinct owners

7

behind 8 agents

Agents with no owner

3

alias or proxy-only · unattributable

Owners w/ ungoverned agents

3

running unbound by policy

Owners w/ critical agents

1of 7

posture < 50

No owner to hold accountable

3 agents answer to no one — a vendor alias (duck.com) or a proxy-only agent with no human behind it: Codex CLI, marketing-gpt, Zed Agent. Until they are joined to a person, their cost and risk land on nobody.

Accountability roster — by owner

7 owners · ranked by risk, then at-risk spend

Every agent's spend, risk, and open findings rolled up to the human who owns it. Unattributable rows have no person to tell, budget, or hold responsible — and are flagged.

Owner
Agents
Spend
At-risk spend
Findings
Top risk
root no identity1 agentmarketing-gpt1 ungoverned$44.10$44.101 high3 sensitive opens Critical
svc-support@qpoint.io team: Svc-support
projected
1 agentsupport-copilot$168.40$168.40none2 sensitive opens Elevated
dev-7f3@duck.com unverified alias1 agentCodex CLI1 ungoverned$78.00$78.00none1 sensitive open Elevated
jane no identity1 agentZed Agent1 ungoverned$0.00none Elevated
mark@qpoint.io team: Mark
projected
2 agentsClaude Code, Claude Desktop$245.50none4 sensitive opens Standard
jane@qpoint.io team: Jane
projected
1 agentCursor$96.20none Standard
svc-data@qpoint.io team: Svc-data
projected
1 agentdata-pipeline-agent$52.30none Standard

Rolled up from agents by owner (email || user), joined to findings + sensitive opens + governanceTaggedSpend logic. Owner is observed; team is projected until the directory join. Distinct from Showback, which ranks identities by risk-weighted spend for chargeback.

By team — projected

directory join · not yet live

Team rollups land when agents are joined to your IdP / SCIM directory. Today we observe the owner identity from telemetry; the team column above is a projected directory attribution. Once joined, this becomes spend & risk per team:

Svc-support

1 agent · $168.40

$168.40 at risk

Unattributed · vendor

1 agent · $78.00

$78.00 at risk

Unattributed

2 agents · $44.10

$44.10 at risk

Mark

2 agents · $245.50

Jane

1 agent · $96.20

Svc-data

1 agent · $52.30

Do next