Agent inventory · shelf-life scoring

Every agent carries an expiration. Print yours.

Paste a list of your agents. Each one gets a Standing Authority Index, a shelf-life band, and an expiration date. The fleet gets a portfolio view: how much exposure a policy would remove for everyone, how much clusters by team, and how much is one strange agent.

Everything runs in this tab. No upload, no storage, no analytics on your rows. Close the page and it's gone.

1 · Load a fleet

Upload CSV

Columns follow the Agent Expiration spec. last_run_at is a date (YYYY-MM-DD) or a number of days ago. trigger is one of scheduled · signed · internal_unsigned · external_unsigned. reach_tier is public · internal · sensitive · regulated. reach_mode is read · write · delete.

Fleet · five numbers

—Armed prevalence

—Overdue agent-daysdormant days past the window, live credential

—Expected reach per probeΣ P(wake) × reach units

—Delegation Rmean fan-out among armed agents

—Concentrationshare of expected reach in top 10% of agents

Shelf-life bands

Fresh Stale Expired Armed

30-day drift

Where the exposure sits

Policy-addressable

Cohort-driven

Agent-specific

By group

Concentration curve

Agents · · click a header to sort

Agent	Owner	Group	Idle days	Trigger	Reach	Deleg.	SAI	Band	Expires	Overdue

How the score works (and how to change it)

Standing Authority Index (SAI) is multiplicative, because the factors interact. An agent that is long dormant, wakeable from outside, holding a live credential, and able to write to a sensitive system is far worse than the sum of those parts.

Dormancy rises with idle days against the window, with an increasing hazard past it. Wake exposure depends on route: scheduled and signed triggers are near zero; unsigned internal is medium; unsigned external is high. Credential is live or expired, and the policy window converts live-but-overdue into expired. Reach is count × sensitivity tier × access mode. Delegation multiplies when the agent can call other agents. Orphaned agents (no owner) multiply again, because nobody will notice.

Bands. Fresh: inside the window. Stale: within the last quarter of the window. Expired: past the window with a live credential. Armed: expired, live, and wakeable by an unsigned route.

Decomposition. Policy-addressable is the share of total SAI that the current window and signing settings would remove, applied to everyone (systematic). Of what remains, cohort-driven is the share explained by differences between groups; agent-specific is the rest (idiosyncratic). The split is a between/within sum of squares, the same arithmetic as a one-way ANOVA.

These weights are priors, not validated. Edit them here; the page rescores live.