Someone in a review asks a simple question: how many tools can your agents call. You start counting. Four teams, a handful of MCP servers each, a few internal APIs wrapped last quarter, two connectors to the same CRM built three weeks apart by people who have never met. Halfway down the page you stop, because what you are writing is not a list, it is an estimate. The policy everyone signed off in the spring — least privilege, a human for anything that writes — has spent six months governing a set that nobody has ever managed to enumerate.

Nothing exists until it is accessioned

A museum is full of objects, and only some of them are in the collection. What separates them is a procedure. An object arrives, and before it goes anywhere someone gives it a number, records who handed it over and on what terms, notes its condition, and names the department answerable for it. Until that is done the thing can sit in the building and still not be put on display, sent to another museum, insured, or handed to a student — not because anyone suspects it, but because nothing about it is known. Storerooms of unaccessioned material are an ordinary, embarrassing feature of large collections, and every rule about handling simply passes them by.

A governed capability registry is that procedure, applied to the things your agents can do. A builder enters an agent, a tool, a skill, an MCP server or a custom resource by hand, or imports its metadata and schema from an endpoint. The record then waits: it becomes searchable, by keyword or by meaning, only after an administrator approves it, and only to the people cleared to see it. A new endpoint that shows up on its own stays invisible until someone signs the record. Visible is the state you have to earn, not the one you start in.

The second connector is a discovery failure

The obvious risk is an agent holding a tool it should not have. The quieter and far more common one is a team that never learns an approved tool already exists. Say a team needs contact enrichment. If search hands back an MCP server that is already approved, with its schema, its owner and its policy attached, they use it. If search hands back nothing, they build a second one — same job, different credentials, different controls — and now there are two surfaces to govern instead of one, and only one of them is written down. Discovery and control are not in tension. A registry people cannot search is a registry people route around.

Turn it around and you get the ordinary case. Finance publishes a tool for order status. A developer picks it out of the registry instead of writing an ad-hoc connector; the agent calls it under the identity assigned to that tool, and cannot reach outward for tools nobody approved. Its reach is what an administrator published to that group and that environment. Which is also why the record has to carry the schema and a description worth reading: a listing that says only that something exists sends the developer back to building.

Ownership is what keeps the list honest

The failure modes carry over from the museum intact. A directory with no enforcement behind it is a printed list of holdings — pleasant, non-binding, quietly wrong within a year. Resources imported from an endpoint and published without anyone reading the schema are objects logged by the trolley-load with no condition report. And a capability updated until its owner and its audit trail are gone is a number on a shelf pointing at nothing. What keeps the record true afterwards is the boring part: telemetry on tokens, latency and errors, tying the entry back to how the thing actually behaves in production, the way a condition check tells you what is deteriorating in storage.

This is why the order matters. The policy engine reading rules as code, the fresh machine handed one action, the gate that stops and asks a person, the identity each server runs under: every one of them takes a set of capabilities as its input. Not one can be applied to something it cannot name. Governance does not start with the rules.

You cannot govern what nobody has written down.