The Fifth Lifecycle: AI Agents Are the New Enterprise Asset Class

Every so often, IT encounters a new kind of actor inside the enterprise. The pattern is familiar: adoption outpaces governance, inventory lags behind use, ownership remains unclear and access accumulates. Security teams ask what the technology can reach and who is accountable. Eventually, IT builds a lifecycle around it. 

We've lived through this before. 

In the 1990s, the new actor was identity. 

In the 2000s, it was devices. 

In the 2010s, it was applications. 

In the 2020s, it became data. 

Now we're entering the fifth era: AI agents. 

And I think that's an important way to think about the governance challenge in front of us. Not as an entirely new problem, but as the fifth enterprise asset class. 

This article explains why agents fit a lifecycle pattern IT already understands, what makes them different from earlier asset classes, and why inventory is the practical first step toward responsible governance. 

The questions haven't changed 

When a new technology enters the enterprise, IT eventually has to answer the same fundamental questions: 

• What do we have? 

• Who is accountable for it? 

• What can it reach? 

• What is it actually doing? 

• How do we protect it? 

• How does it go away? 

We asked those questions about employees and their identities. We asked them about laptops and mobile devices. We asked them about applications—especially the ones that appeared outside traditional IT processes. We asked them about data as information spread across sites, mailboxes, endpoints and cloud services. And now we need to ask them about agents. The subject has changed. The control problem hasn't.

Every new asset class starts unmanaged 

Think about what happened in each of the previous eras. 

Identity management evolved from basic domain accounts into directory services and modern identity platforms. The lifecycle became something everyone in IT understood: 

Join. Move. Leave. 

Device management followed a similar path: 

Enroll. Configure. Prove compliance. Patch. Wipe. Retire. 

Applications introduced another set of governance questions: 

Discover. Register. Scope consent. Review. Decommission. 

Then came data. As information proliferated across Microsoft 365, SharePoint, mailboxes and endpoints, organizations had to develop ways to: 

Classify. Protect. Retain. Audit. Dispose. 

Different technology. Different tools. Different risks. But underneath them was the same organizational muscle: 

Inventory it. Give it an identity. Assign an owner. Define its scope. Observe it. Secure it. Retire it. 

We've built this muscle four times. Agents are the fifth. 

The difference is that agents act 

There is, however, something important about this fifth asset class. An agent isn't just something sitting in the environment waiting for a human to interact with it. It can reason across information, invoke applications, retrieve data, and take actions on someone's behalf. That changes the consequences of poor governance. 

An employee with excessive access is a problem. An application with excessive permissions is a problem. An overshared repository is a problem. An agent operating across those systems can compound all three: it can surface exposed information faster, connect it across sources, and act on it at scale. The agent may not create the underlying permission problem, but it can dramatically increase the problem’s reach and operational impact. 

That's why agent governance can't be separated from the governance disciplines that came before it. 

The uncomfortable truth: your data matters more than your model 

This may be one of the most important ideas in agent governance. An agent isn't useful simply because of the model behind it. It's useful because of what it is allowed to see and do. 

Consider a simple example: 

An employee asks an agent a question. The agent is grounded in information from a SharePoint site or another enterprise knowledge source. If that employee already has access to the underlying information, the agent can work with it in that user's context. 

The agent didn't necessarily grant the employee new access. It reflected the access that was already there. That sounds reassuring, until you realize what it means. 

If the organization has years of stale documents, poorly governed sites, excessive permissions, unclear ownership and sensitive information that was never properly classified, the agent may expose those weaknesses much faster than a human ever could. 

For years, an overshared document could remain effectively hidden because nobody knew it existed. Now someone can simply ask a question. The permission didn't change. The obscurity did. Agents make existing information easier to discover, which means the agent lifecycle depends directly on the data lifecycle. 

If your content has no lifecycle, your agent inherits the absence of one. 

Governance should enable adoption, not block it 

Agent adoption creates a familiar tension: business teams want to build, while IT and security teams need visibility into what agents can access and do. Those objectives do not have to conflict. 

We've seen this movie before with devices and applications. Bring-your-own-device programs didn't eliminate the need for device management. Shadow IT didn't eliminate the need for application governance. Instead, organizations eventually developed ways to discover what existed, establish ownership, control access and manage the lifecycle. 

Agents will require the same evolution. 

The goal shouldn't be to create a governance process so cumbersome that nobody can build an agent. Nor should the goal be to let an uncontrolled population of agents grow indefinitely. The goal is to make responsible agent adoption operationally possible. 

That starts with visibility. 

Start with inventory, not policy 

One of the easiest mistakes an organization can make is beginning the agent conversation with a policy question. A more useful starting point is visibility: before deciding what the policy should be, establish what agents already exist and how they are connected.

• Who built them? 

• Who owns them? 

• What are they connected to? 

• What data can they reach? 

• What identities do they use? 

• What are they doing? 

• Which ones are still needed? 

• Which ones have effectively become digital orphans? 

You may discover that the agent population is already larger than anyone in the room expected. That number is more than an inventory statistic: it reveals the scale of unmanaged ownership, access, connections and lifecycle risk. It gives leaders a concrete starting point for prioritizing governance resources and controls—and a business case grounded in what already exists. 

The fifth lifecycle 

The good news is that we don't have to invent this from scratch. The emerging agent lifecycle is remarkably familiar: 

Register. Identify. Sponsor. Scope. Observe. Secure. Retire. 

The technology supporting those controls will continue to evolve. Platforms will change. Agent architectures will change. The way agents interact with applications and data will change. But the organizational questions are likely to remain remarkably stable. 

• Who owns this? 

• What can it do? 

• What can it see? 

• How do we know what it's doing? 

• How do we know when it should stop? 

Those are not AI questions. They're enterprise governance questions. And that's the mindset shift I think organizations need to make. 

AI agents may feel unprecedented, but the governance pattern is not. IT has repeatedly moved new classes of technology from unknown to inventoried, owned, controlled, observed and retired. Agents are the latest—and arguably the most consequential—addition to that lifecycle. 

The question, then, is not how to invent governance for AI agents. It is how to apply the governance discipline we have spent decades building to a fifth enterprise asset class. The pattern is familiar, and that makes the problem far more manageable. 

And it starts with a surprisingly simple first step: 

Inventory it. 

Because before you can govern the agents you intend to build, you need to understand the agents that are already there. 

This is the first article in a series exploring the fifth lifecycle of enterprise IT: governing AI agents alongside identities, devices, applications and data. The next articles will examine the controls organizations need to turn visibility into durable ownership, security, observability and responsible retirement practices.