Building a Copilot Studio agent inventory to meet NYDFS Part 500 asset management requirements

What counts as an in-scope asset

Section 500.13(a), as in force and as of November 2026, requires written policies and procedures designed to produce and maintain a complete, accurate and documented asset inventory of the covered entity's information systems. The inventory must be maintained in accordance with those policies. DFS considered the Second Amendment comments on this section and made no change, stating that an inventory is a critical part of identifying the assets that need protection.

The regulation does not list individual agents, so the scope decision belongs in your written policy. A practical position is to treat a Copilot Studio agent as in scope when it can read nonpublic information, call a connector, or invoke a tool or action. The agent definition is one asset. The components it depends on are inventory candidates in their own right: the environment that hosts it, the data and knowledge sources it reads, the connectors and actions it can call, and the identity and credentials it uses.

DFS states that the inventory policies are part of the cybersecurity program, which rests on the covered entity's risk assessment. Record the scope rationale and tie it to that risk assessment. An examiner is more likely to accept a documented, risk-based boundary than an unexplained one.

Setting the review cadence

Section 500.13(a) requires the policies to set the frequency to update and validate the inventory, but the text does not prescribe a number. The DFS template for individual licensees and small entities suggests reviewing the inventory generally once a year and when the business changes significantly. That template targets a different population, so a larger covered entity should set its cadence from its own risk assessment and explain the reasoning.

Agents change faster than most systems, because a maker can add a connector in minutes. A cadence based on change events, with a periodic full reconciliation behind it, tends to hold up better than an annual snapshot alone. The template also prompts you to document where the inventory is kept so that it is available in a disaster, which is worth answering explicitly.

DFS's October 2024 industry letter on AI cybersecurity risk imposes no new requirements. It applies the existing Part 500 framework, including the requirement to review access privileges at least annually so each Authorized User keeps only the access needed for the job. Reviewing the tool and data permissions recorded for each agent alongside that access review is a sensible way to connect the two.

Runtime evidence that supports the inventory

An inventory states what an agent is configured to reach. It does not show what the agent was permitted to do in a given interaction, or what it did. That gap is where runtime enforcement adds evidence. Presented to an examiner, runtime records support the inventory and the review process. They do not replace either.

Trussed enforces policy in the execution path on agent interactions and tool calls: allow, redact, block, rate limit, or escalate for human approval. Enforcement happens at runtime, not review after the fact, and each decision produces audit-ready evidence mapped to NYDFS, among other frameworks. Comparing the agents and tools that appear in that evidence with the inventory shows where the two diverge, and an escalation record shows that a person approved a sensitive action. The scope is individual interactions and tool calls. It is not end-to-end tracing of agentic workflows.

Trussed has run in continuous production for 18+ months in a regulated enterprise, with customers in insurance, pharma, healthcare, and education. Its evidence base is built for regulated enterprises that must show what their AI was allowed to do and what it did.

What an inventory alone does not demonstrate

A complete inventory shows that you know which agents exist, who owns them, and what they are connected to. It is a point-in-time statement of configuration. It does not show that a connector permission was never exercised outside its intended purpose, that nonpublic information was redacted before reaching a model, or that a high-risk action was approved by a person.

For a CISO preparing for examination, the practical test is whether you can show three things together: the written policy and scope decision, the dated record of inventory validation, and records of what specific agents were allowed to do and did. The first two satisfy the inventory requirement. The third gives the inventory credibility, because it shows the recorded attributes match observed behavior.