Input format: the agent inventory
The inventory answers the first board question: which agents exist, what each serves, what each may do, and who is accountable.
To load it, sign in as the operator and open Administration. Under Load the agent inventory, enter the organisation id and choose the file. The page reports what it mapped and who attested the hand-typed entries. The map shows the result after the projectionProjectionThe regular pass that brings the read model up to date with the canonical log. It runs every 30 seconds by default. service’s next pass (about 30 s by default). A refusal names what was wrong.
A customer installation takes platform-signed AgentFactsAgentFactsA signed statement from an agent about its allowed work, its permissions and the person answerable for it. only from the estate’s boundary feedBoundary feedRecords supplied by the customer’s own systems about activity at the edge of an agent or service. NovusLens reads those records; it does not watch the agent., with each subject’s key enrolled. Run this from the installation directory (see Run operator commands):
./lens connectors boundary --org harbour --gateway <estate-host>:<gateway-port> --enrolment <file>A file with signed documents and no enrolled keys is refused, through Administration or the command line. The command line has no signed-in person, so it refuses hand-typed entries too.
Two lists, two rungsRungOne of three levels of support for a recorded value: told, shown or measured. The level appears beside the value.
agents: platform-signed AgentFacts documents, where the agent platform issues them. Each is a signed envelopeEnvelopeThe surrounding fields that identify a message, its sender, its type and its time, alongside the message's data. around adocumentwith the fields below. A document whose signatureDigital signatureA check calculated with a signing key that can detect whether a record has changed. Identifying the signer also requires a trusted link between that key and its owner. verifies lands at the shown rung. One that does not verify is raised as a findingFindingA difference in the records that needs a decision. It includes its sources and can describe a slow handoff, disputed fact or missing owner. and is not mapped.attested: hand-typed entries, one per automation, with the same fields. These land at the told rung, labelled with the signed-in person who loaded the file.
Either list may be empty. Most first installs have only attested.
Fields per entry
agent_id: required. Stable, lower case, no spaces.label: the display name.serves: the id of the cellCellA box on the map that stands for a team, service, supplier or AI agent. It is a unit you can inspect, not necessarily a department or a person. the agent works for. Withdeclared_capabilitythis draws the agent’s edge into the map.declared_capability: what the agent does, as a short id.granted_authority: what the agent may decide, in one sentence.accountable_owner: a name or role.
Minimal valid example
{
"agents": [],
"attested": [
{"agent_id": "customs-prefill", "label": "Customs pre-fill assistant", "serves": "customs",
"declared_capability": "declaration-prefill",
"granted_authority": "drafts declarations; a person files them",
"accountable_owner": "Head of Customs"}
]
}What is not in this file. Authority grants, operations, interventions, outcomes and activity are evidence, not inventory. They are signed records that an enrolled source sends under the agent evidence contract, and there is no form for typing them in. A remitRemitA written list of an agent’s allowed actions, resources and destinations for information. The list states whether it is complete. is the one exception: a responsible person can declare it in the product, where it is approved under two recorded checks and labelled declared in product (see Declare a remit in the product). Until a source sends activity, the second board question is still answered “authority not established” or “cannot be stated”, which is the honest answer.
What a re-run does
| Situation | What happens |
|---|---|
| Stable identity | The agent id, slugged. A bundle with attested entries is re-serialised with the attester’s signature, so its artifact differs from the file’s. |
| The same bundle twice | The same values written again; no change. |
| A changed label, cell served, authority or owner | A signed entry: the latest wins. An attested entry is told and cannot change a value a signed document set; a differing account opens a provenance-conflict finding. |
| An owner or authority omitted from an entry | Kept as it was, at any rung. An omission is “not stated”, never a removal. |
| An agent omitted from the bundle | Untouched, still on the map. There is no removal. |
| An agent that now serves a different cell | Gains the new edge and keeps the old one. |
| A signature that fails | Not mapped; an agent-facts-unverified finding opens and does not close by itself when a corrected bundle lands. |
| Attested entries without an attester | The whole bundle is refused. |