Software Technologies Inventory and Attributes

The relationship between the Software Technologies Inventory and the AI Agents Inventory is one of consumption, and it is the newest of the relationships this inventory maintains. AI agents are built on and run within the technologies governed in the Artificial Intelligence and Machine Learning Software category: machine learning frameworks, model training and serving software, vector and embedding stores, and compute acceleration software. The AI Agents Inventory is authoritative for the agents themselves — their identity, ownership, authority, autonomy, and reach. This inventory is authoritative for the technology layer beneath them. The two are governed separately because they have genuinely different lifecycles: an agent is deployed and retired as an actor in an enterprise process, while the framework it runs on is procured, versioned, patched, and supported as a technology.

The connecting attribute on this side is AI Agents Running On in the Relationship Attributes category, derived from the AI Agents Inventory and populated only for technologies in the artificial intelligence and machine learning category. From the agent side, the equivalent attribute names the technologies the agent depends upon. The Software Bill of Materials Reference in the Security Attributes category extends the chain further, because a machine learning framework typically carries a substantial dependency tree of its own, and much of the exposure in an AI stack sits in those transitive components rather than in the framework itself.

The governance value is that AI oversight becomes traceable through the layer it actually depends on. Well governed, a disclosed vulnerability in a machine learning framework resolves immediately to the governed agents running on it, their owners, and the processes they act within — rather than triggering a manual survey of who is using what. It also lets an enterprise answer a question regulators increasingly ask: what does this AI system actually run on, and can you demonstrate that the components beneath it are governed. Poorly governed, an enterprise can hold a complete AI agent inventory and still be unable to say whether the technology layer supporting those agents is supported, patched, or even known.