Creating an Agent Ownership Policy

When agents are discovered across your AI platforms, they can arrive without a single technician listed as accountable for them. Agent Ownership Policy in ManageEngine SecureAI automatically assigns accountability across every AI platform you have onboarded, ensuring that each discovered agent has a named owner when it appears in your inventory. An owner is the person SecureAI turns to when a decision has to be made about an agent, such as whether a request for access to an agent should be granted or whether the access the agent already has is still needed.

Use Agent Ownership Policy to establish who owns each discovered agent. Agents discovered later are matched by the same policies, so new agents receive owners without any need for manual configuration. The owners a policy assigns are recorded under each agent in the agent inventory. This is also where the owner of an individual agent is set manually.

How owners are assigned, and how current the agent details are

Every agent a policy can act on comes from the syncs that run against your onboarded instances. A sync records the agents an instance holds and the attributes the instance exposes for each agent. Those attributes include the agent name, the directory roles and API permissions the agent holds, and the Model Context Protocol (MCP) servers and knowledge sources it draws on. Those attributes are as current as that instance's last completed sync. The attributes you can test depend on the platform you choose since platforms do not report the same details about their agents.

A policy is a set of conditions written against those attributes, combined with a criteria pattern that states how the conditions relate to each other. Policies are evaluated when new agents are discovered and are executed when an administrator runs them. Evaluation follows the priority order recorded against each policy. The first policy whose conditions an agent satisfies is the one applied. Its owners are written to that agent and no further policy is considered for it. Ownership set manually against an individual agent is left alone, so policy runs do not overwrite deliberate exceptions. Every run is recorded with the policies applied, the technician who ran them, and the agents and owners that resulted. A technician sees and changes only what their delegated role allows.

Prerequisites

The following must be in place before a policy can assign owners.

• Have a SecureAI license that covers Governance.
• Log in as Super Admin or as a help desk technician whose role carries the Agent Ownership Policy task under Access Configuration. The default Governance Manager role carries it, as can a custom role. Add the task's Edit and Delete properties to change or remove a policy.
• Under Application Settings, add the AI platform instances holding the agents you want covered and sync each one.
• Confirm that the people you intend to name as owners are available to SecureAI, either from a connected directory or as SecureAI users.

Configuration instructions

1. Navigate to Governance > Access Configuration > Agent Ownership Policy.
2. To see how agents reach their owners, click the ownership architecture icon . The Agent Ownership Architecture feature traces discovered agents through each policy's conditions to the first match based on priority and the owners assigned on each platform.
3. To create a policy, click Add New Policy.
4. Enter a name in Policy Name. Click Description and say what the policy covers.
5. A policy applies to the agents whose attributes match its conditions. In Assignment Conditions, click Add Condition to create the first one. A policy with no conditions applies to every agent.
6. Each condition tests one attribute of one platform. In the condition you added, choose the agent platform, then choose the attribute to test. Each platform offers its own set of attributes.
7. Choose how to compare the attribute, then enter the value to match.
8. To add a second condition, click the Add icon on the condition you already have. A joiner appears between them, set to AND. Click the joiner to switch it to OR, and click it again to switch back.
9. Criteria Pattern shows how your conditions combine, for example (1 OR 2). To group them differently, click the field's edit icon, enter the condition numbers with AND, OR, or both, then confirm.
10. Every policy needs at least one owner. In Owners, click the Add icon and choose who will own the agents the policy matches. Click Save to return to the policy.
11. Click Save.
12. To change the order SecureAI checks your policies, click the prioritization icon and drag the policies into the order you want, then click Save. Each policy takes its priority number from its place in that order.
13. Click the Disable icon on a policy to take it out of use, and the Enable icon to bring it back. To act on several policies at once, select them and click Enable, Disable, or Delete. A disabled policy is skipped but keeps its priority.
14. Click Run Policy to apply your enabled policies to the agents already discovered, without waiting for the next discovery. Agents with a manually set owner are left untouched.
15. Click Assignment History to review previous policy runs. In Time Period, select the period to cover. Each run lists the policies applied, the technician who ran them, and whether it succeeded. Click View Details to display the agents a run updated, the owners assigned to them, each agent's platform, and the policy that made each assignment.

Tips

• To find the agents your policies are missing, look in AI Agents inventory for agents owned by SecureAI Admin. To cover them, either add a condition to an existing policy or create a policy with no conditions and give it the lowest priority.
• To split ownership across teams, give each team a policy keyed on something its agents share, such as a name prefix or a directory role. Keep platform-wide policies below them.
• Name owners who can act on a request, not people who are only nominally responsible. The reviews an owner receives are set in Governance Assigning Rule.