> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opal.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent Inventory

> Track and govern the AI agents operating in your organization from a dedicated inventory.

<Info>
  Agent Inventory is currently in limited beta. Contact Opal support to enable it for your organization.
</Info>

The **Agent Inventory** tracks AI agent identities in your organization—separately from human users and other non-human identities—so you can see what agents exist, who's accountable for them, and what they can access.

<Note>
  Agent Inventory tracks AI agents that operate as identities in your environment, such as Claude or Bedrock agents with their own credentials and access. This is distinct from [Paladin](/docs/paladin/overview), Opal's own platform for building agents that review access requests.
</Note>

Each agent in the inventory has:

* A **source**, indicating how it was ingested—see [Agent sources](#agent-sources)
* A **tier**—Unknown, Supervised, Autonomous, or Orchestrator—reflecting the agent's degree of autonomy. Agents default to Unknown until an admin classifies them.
* A **harness**, the framework or platform running the agent
* A **purpose**, a short description of what the agent is for
* Linked identities, plus resource and group counts

## Requirements

Before you begin, you must:

* Be an Opal Admin

## Agent sources

| Source               | Description                                                                                                                                                            |
| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Anthropic            | Synced from an [Anthropic](/integrations/anthropic) connection—covers Anthropic service account and API key principals, plus usage-based detection of agentic activity |
| Okta Directory       | Synced from an Okta Directory connection, using one of several source types—see below                                                                                  |
| AWS / AWS SSO        | Synced from an AWS or AWS SSO connection—covers Amazon Bedrock AgentCore agents                                                                                        |
| Re-labeled from user | An existing user or service account identity that an admin has promoted to an agent                                                                                    |
| Manually created     | An agent created directly in Opal, without an underlying connector                                                                                                     |

## Sync agents from a connector

To ingest agents from a connector, the underlying connection must already exist in Opal—for example, an [Anthropic connection](/integrations/anthropic) or an [AWS connection](/integrations/setting-up-your-aws-organization-in-opal).

1. Go to **Inventory** > **Agents**.
2. Select **Sync from connectors**.
3. Choose a connection to sync from.
4. Depending on the connection type:
   * **Anthropic**: Review the candidate service accounts, API keys, and usage-based detections, then select which to ingest.
   * **Okta Directory**: Choose a source—**Directory user types**, **Service & OAuth apps**, **Okta for AI Agents**, or **Scan directory**. Okta for AI Agents imports directly with no review step; the other sources surface candidates for you to review before confirming.
   * **AWS / AWS SSO**: Bedrock AgentCore agents are imported directly, with entitlements granted automatically.
5. Confirm the import.

## Re-label existing identities as agents

If an existing user or service account is actually an AI agent, you can re-label it instead of creating a duplicate record.

1. Go to **Inventory** > **Agents** and select **Add Agents**.
2. Opal surfaces candidate identities that look like agents, based on their attributes and access patterns.
3. Select the identities to promote, then confirm.

Promoted identities appear in the Agent Inventory with source **Re-labeled from user**.

## Manually create an agent

You can also create an agent directly, without syncing from a connector.

1. From the Inventory, open a user or non-human identity record.
2. Select **Link to Agent** > **Create new agent**.
3. Fill in the agent's details:
   * **Name** (required)
   * **Owning group** (required)
   * **Accountable sponsor**
   * **Purpose**
   * **Tier**: Supervised, Autonomous, or Orchestrator
   * **Harness**
   * **Members**—the identities this agent assumes
4. Save the agent.