Skip to main content
Agent Inventory is currently in limited beta. Contact Opal support to enable it for your organization.
The Agent Inventory tracks AI agent identities in your organization—separately from human users and other non-human identities—so you can see what agents exist, who’s accountable for them, and what they can access.
Agent Inventory tracks AI agents that operate as identities in your environment, such as Claude or Bedrock agents with their own credentials and access. This is distinct from Paladin, Opal’s own platform for building agents that review access requests.
Each agent in the inventory has:
  • A source, indicating how it was ingested—see Agent sources
  • A tier—Unknown, Supervised, Autonomous, or Orchestrator—reflecting the agent’s degree of autonomy. Agents default to Unknown until an admin classifies them.
  • A harness, the framework or platform running the agent
  • A purpose, a short description of what the agent is for
  • Linked identities, plus resource and group counts

​
Requirements

Before you begin, you must:
  • Be an Opal Admin

​
Agent sources

​
Sync agents from a connector

To ingest agents from a connector, the underlying connection must already exist in Opal—for example, an Anthropic connection or an AWS connection.
  1. Go to Inventory > Agents.
  2. Select Sync from connectors.
  3. Choose a connection to sync from.
  4. Depending on the connection type:
    • Anthropic: Review the candidate service accounts, API keys, and usage-based detections, then select which to ingest.
    • Okta Directory: Choose a source—Directory user types, Service & OAuth apps, Okta for AI Agents, or Scan directory. Okta for AI Agents imports directly with no review step; the other sources surface candidates for you to review before confirming.
    • AWS / AWS SSO: Bedrock AgentCore agents are imported directly, with entitlements granted automatically.
  5. Confirm the import.

​
Re-label existing identities as agents

If an existing user or service account is actually an AI agent, you can re-label it instead of creating a duplicate record.
  1. Go to Inventory > Agents and select Add Agents.
  2. Opal surfaces candidate identities that look like agents, based on their attributes and access patterns.
  3. Select the identities to promote, then confirm.
Promoted identities appear in the Agent Inventory with source Re-labeled from user.

​
Manually create an agent

You can also create an agent directly, without syncing from a connector.
  1. From the Inventory, open a user or non-human identity record.
  2. Select Link to Agent > Create new agent.
  3. Fill in the agent’s details:
    • Name (required)
    • Owning group (required)
    • Accountable sponsor
    • Purpose
    • Tier: Supervised, Autonomous, or Orchestrator
    • Harness
    • Members—the identities this agent assumes
  4. Save the agent.
Last modified on September 10, 2026