Late in my time running artificial intelligence governance for a global enterprise of more than 120,000 people, I sat in a review where the security team walked us through the monitoring screen, and the screen was full. Something had queried a customer system several thousand times in an hour. Something had opened a connection to a vendor's service that nobody in the room remembered approving. Each line was flagged, each flag was correct, and I asked the same question about every one of them. I did not need to ask what it had done, because the screen said that plainly. I needed to know which agent it was, who had built it, who owned it, and under what authority it had acted. The answer in each case was a shrug and a plan to pull the logs, and the logs, when they came, called the thing by a different name in every system it had touched.
If you advise companies, you have sat in a smaller version of that meeting. The firms I talk to now are a thousandth of that size, and the screen is the same screen, with fewer lines on it and the same shrug. The monitoring works. It sees everything. What it cannot do is say what it is seeing, and a leader looking at a wall of activity that nobody can attribute is in a strange position, because they are better informed than they were last year and no closer to being able to act. You cannot ground what you cannot name. You cannot call the owner of a thing that has no owner on record. And you cannot tell a regulator, or a board, which agents touched the customer's account and in what order, when the agents were never given a name that the systems they touched would recognize.
I have been using one picture for this since before I wrote it down, and it comes from a sky.
On any given day tens of thousands of commercial flights move through the airspace over the United States, on different routes, flown by different airlines, all at the same time, and none of them collide. No one supervises each flight individually. No central authority approves every turn. The system works because of two things, and only two. The first is the tail number. Every aircraft carries a unique, persistent, non-transferable identifier painted on the fuselage and broadcast by its transponder, and that number tells the entire aviation system who is up there: this aircraft, belonging to this airline, with this maintenance history, flown by this crew, under this flight plan. In the book I put it in six words: "No anonymity, no ambiguity, no dark zones." The second is air traffic control, which tracks every identified aircraft, manages the flow, assigns altitudes, prevents conflicts, and, when something goes wrong, grounds one specific aircraft or clears a whole sector in minutes.
Neither works alone, and that is the part of the picture I want you to carry out of this page. Tail numbers without air traffic control make a registry nobody watches. Air traffic control without tail numbers is a system that cannot name what it is tracking, so it tracks blips.
The framework I lay out in the book borrows both words from aviation and uses them plainly. Every agent gets a Tail Number, and the layer that watches the whole fleet is Air Traffic Control, which the framework places under its Orchestration pillar. I borrowed the words because the aviation system solved, decades ago and at a scale no company will reach, the exact problem the monitoring screen was showing me, and it solved it from the inside of the aircraft out. The identity is on the plane. The plane broadcasts it. The radar does not have to guess.
An agent without a number is what a radar operator would call an unidentified flying object, a UFO, and the definition the framework carries says the rest: A Tail Number is an agent's addressable self: a unique, persistent, non-transferable identifier that every other system recognizes. It is one half of the Identity pillar; the Manifest, the declared self, is the other. Declaration without addressability cannot be enforced across systems, and addressability without declaration is a serial number with no meaning attached. An agent without a Tail Number is a UFO, an unidentified flying object: surveillance can see the blip but cannot name it, attribute it or decide whether to ground it.
I would put the last of those sentences on the wall of every security operations room I have ever stood in, and the line underneath it is the claim this whole page rests on: "Surveillance without inside-out identity is a sky full of unidentified objects."
I spent a career on the perimeter, so I will say what the perimeter does before I say what it cannot. Executives commonly believe that the perimeter plus endpoint surveillance is sufficient for agents. I believed it for longer than I like to admit, and the belief is not foolish, because those tools are necessary and they work as sold. They flag the anomaly. The framework's statement of the problem is short, and I will give it as written: Perimeter and endpoint surveillance flag anomalies in agent behavior but cannot say which agent it was, who owns it or under what authority it acted, because the agents were never given an identity from the inside. A UFO is an identity failure. The perimeter sees the door. The surveillance sees the blip. Only something carried inside the agent can give the blip a name, and in the book I put the conclusion in one line: "The fix is a tail number, not a better sensor."
This is why I say that inside-out governance completes the governance a client already runs, and never that it stands in for any of it. A defensible enterprise runs three postures. The perimeter, the outside-in posture of governance, risk and compliance, states what must be true and stops intruders at the door. The five living pillars of the framework make the standard true at every decision inside the entity, at machine speed. An independent observer, outside the agents' own reports, catches the governance that has been subverted beyond what an agent will say about itself. The perimeter says what must be true; the framework makes it true at every decision and proves it. The first thing a leader has to be able to trust is that the AI itself is trustworthy, because its governance travels inside it, and the first proof that an agent is carrying anything inside it at all is that it answers to a name.
On the map of the framework, five pillars by three signatures, the Tail Number lives under Identity, and Identity is the pillar that answers one question: who are you, and what may you do? The pillar has two halves, and they are halves of one surface rather than two pillars. The Trusted Living Agent Manifest is the declared self, the file an agent reads before every move, which says who it is, what authority it holds and where its limits are. The Tail Number is the addressable self, the handle every other system recognizes. A manifest with no number is a job description with no employee number, honored inside the one system that wrote it and invisible everywhere else. A number with no manifest is a serial number, and a serial number tells you which thing acted and nothing about whether it was allowed to.
Most organizations have something that looks like the second half and is not. The example I used in the book is the agent called CustomerService-v3 in the deployment system, CS_Agent on the monitoring dashboard and support-bot in the log files: three names, one agent, and no way to follow it across the four systems it passed through on its way to the customer. Those identifiers are local, and the whole point of the number painted on an aircraft is that it is not.
When a partner assesses a client on this pillar, the question is the one above, and the answer sits on a gradient of three levels that run in order. An agent describes itself first: it can state who it is, what it is for and what it will not do. It reports itself second: every action it takes carries its number and its reason, so that nothing it does is silent. It governs itself third: it enforces its limits at the point of decision and not in a review the following week. The levels are words and not numbers, and a partner can read a client's sky with those three words faster than with any dashboard. I ask to see the register, then one log line from each system an agent touched with the same number on every one of them, then the name of the person who answers for that number, and then a number that was retired and never issued again.
That last piece is the one I would underline for the leader reading over the partner's shoulder. In the method I run, every agent carries a number that is never reused and that names its owner. When the agent is retired, its number is retired with it, so that its record always refers to one thing, and when the person who built the agent leaves the firm, the register shows the agent as unowned the next morning rather than at the next audit. That is the seventh thing the framework lets a leader trust, and I will say it once, in the plainest form I have. It lets you trust that a named person owns every agent that runs in your name, it shows you the one whose owner has left, and it proves, from the log lines themselves, which agent touched what.
What the client holds afterward is the inventory: every agent in the building found rather than assumed, each with its number, its owner and its purpose, the first lens of the living twin the engagement builds and the thing the client keeps current after the engagement ends. I will not describe the register's layout here, or the scheme the numbers follow, because that part of the method is delivered behind the partner door and not on this page. What matters is that there is one, that it is the same in every system, and that someone answers for it.
If you deliver this method, the first morning at a client is spent on this pillar before any other, not because Identity is the most sophisticated of the five but because the other four cannot be assessed without it. You cannot say what data an agent touches, where it runs, what it does or how it works with others until you can say which agent you mean. The first thing I would ask a client to do is point at the monitoring screen and name one line on it, and the engagement begins with however many lines they cannot. A demonstration twin on this site, built for a fictional firm, shows what the sky looks like once the agents in it are named and which blips are left over as unidentified, and I would rather you looked at it than took my word for it.
There is a thread I have not tied off, and I will leave it where it lies. More and more of the agents in a client's building arrive inside a vendor's product, carrying the vendor's identifier and reporting to the vendor's console, and the client has no more issued them a number than an airline issues one to a plane it chartered. Whether a Tail Number issued by the organization the agent acts for can be made to stick to an agent the organization did not build is a question I am still working on. I suspect the answer is the one the airlines arrived at, which is that the register belongs to whoever answers for the flight, and I am not yet sure every vendor will agree.
The method that gives every agent a name is being licensed to a small number of partners first, and a named bench is forming here: the founding partner waitlist.
