Discovery sources: what we see, what we can do, what we need
The Agentic Control Plane finds agents your teams built on other platforms. This page states, for each platform, exactly which permission we ask for, what that permission lets us do, and where our integration stops — so your IT team grants nothing it does not understand, and you never assume a control you do not have.
The rule: read-only by default
Discovery asks for read-only access. With it we can list your agents; we cannot change, run, stop or delete them, and we cannot read their conversations.
Every further capability is an option you switch on, explained by what it unlocks — for example: "to be your kill switch for these agents, we need permission to disable and re-enable them; without it, we can tell you an agent is risky, but we cannot stop it." Turning an option off tells you which permission you can withdraw.
Three depths, three different promises
| Depth | How an agent gets there | What you can rely on | What you cannot |
|---|
| Observed | Found by a discovery source below. | It is in your register with its platform, owner (where the platform says) and on/off status; changes of owner and status are tracked and raise a security case; a first EU AI Act screen based on its name and description. | What it did, and anything its platform does not report. No stop: our kill switch does not reach an agent that never calls us. No chat: it runs where it was built, so you talk to it there — MeetLoyd never answers in its name. |
| Gatewayed | Your team points the agent's model endpoint (and, where supported, its tools) at MeetLoyd. | Every call is identified, checked against tool policy and budget, logged, and refused when the agent is halted. | Only the calls that pass through us — an agent that also calls its provider directly is governed only for the calls we see. |
| Native | Built on MeetLoyd. | Everything, from creation. | — |
An agent that runs inside a vendor's own runtime (a managed agent service, a SaaS bot) usually cannot be gatewayed: its calls never leave that runtime. For those agents, a stop can only come from the platform itself, through the containment permission described per platform below — available only where marked.
Status says whether we have run the integration against a real account. Verified means we did, with exactly the permission listed. Documented means it follows the platform's published API but has not yet been run against a live account — treat the first sweep as the test.
Microsoft Entra (Copilot Studio, Azure AI Foundry, app registrations)
| |
|---|
| Permission (default) | An app registration with the Microsoft Graph application permissions Application.Read.All and AgentIdentity.Read.All, admin-consented. |
| What it allows | Read the service principals and agent identities in your directory. Nothing else — a write attempt with this permission is refused. |
| What we find | Agent identities: Copilot Studio / Power Virtual Agents principals, bot registrations, app registrations tagged or named as agents, the Entra Agent ID each Azure AI Foundry agent receives (recorded with its Foundry project and region), and the Entra Agent ID Copilot Studio gives every agent created since May 2026 (recognised by the Copilot Studio blueprint it is created from). Ordinary business apps are deliberately not matched. |
| Limits | An identity, not an agent's configuration: for app registrations and Copilot Studio principals, no tools, knowledge or model — only what Entra holds (name, description, owners). Foundry agents of the older "assistants" generation have no Entra identity and are not found here. |
| Option — owner names | Add the Graph application permission User.ReadBasic.All. Without it Entra tells us an agent has owners but not who they are; the agent page says so. It reads names and email addresses only. |
| Option — Foundry details | Give the same app the read-only Foundry role (see Azure AI Foundry below) on each Foundry account. Each Foundry agent found in Entra is then completed with its model, description, tools and version. Its instructions are not kept. |
| Status | Verified (October 2026), Foundry details included. The owner-names option is documented. |
| Where it is set | Tools → Secrets → Microsoft service account: Directory (tenant) ID, Application (client) ID and the client secret value, then Test connection. The Set it up button on the Entra source leads there. It is shared with other Microsoft features — see the note below. |
Microsoft Copilot Studio (Dataverse)
| |
|---|
| Permission (default) | An Entra app added as an Application User with a role that can read the bot table, in each Power Platform environment to sweep. |
| What it allows | Read bot records: name, publication state, owner, language, dates. |
| Limits | Topics, actions and knowledge are not read today. Each environment must be listed (or enumerated through the Power Platform API, which needs the app registered for it). |
| Status | Documented. |
Azure AI Foundry Agent Service
| |
|---|
| Today | No dedicated source yet. Current-generation Foundry agents are found through Entra (above). |
| Read permission (verified) | A custom Azure role with control-plane read on AI Services accounts, projects and deployments, plus the data actions Microsoft.CognitiveServices/accounts/AIServices/agents/read and …/OpenAI/assistants/read. It lists both agent generations with their model and tools; every write is refused. |
| Containment permission (verified, not yet offered) | The data actions …/AIServices/agents/state/disable/action and …/state/enable/action — nothing else. They let MeetLoyd disable an agent at the source: while disabled, the agent refuses every request; re-enabling restores it. Older "assistants" agents have no disable — only deletion, which we will not offer. |
AWS Bedrock
| |
|---|
| Permission (default) | An IAM user or role with read-only actions, in the regions you list: bedrock-agentcore:ListAgentRuntimes, bedrock-agentcore:GetAgentRuntime, bedrock-agentcore:ListHarnesses, bedrock-agentcore:GetHarness and bedrock:ListAgents. |
| What it allows | List and read agents. Nothing else — no agent can be called, changed or deleted with these actions. |
| What we find | Amazon Bedrock AgentCore, AWS's agent platform: each agent runtime (name, description, status, the IAM role it runs as, its container or code package, network mode, how callers authenticate, and the names of its environment variables) and each harness (model, tools, skills, role). Classic Bedrock Agents (name, status, description), which AWS keeps running for the accounts that already used them. |
| Option — tool gateways | Add bedrock-agentcore:ListGateways, GetGateway, ListGatewayTargets, GetGatewayTarget and GetPolicyEngine. Each AgentCore gateway is then listed under the AWS source with the tools it serves, what answers them (function or API) and whether a policy engine checks each call. A gateway that a harness names is attached to that agent. A gateway whose calls nothing refuses (no policy engine, or one that only logs) files a finding in the risk register. |
| Never kept | Environment variable values — AWS returns them to a read-only caller, and they often hold secrets — and a harness's system prompt. |
| Limits | An agent runtime's model is set in its code, so it is not known. For classic agents, the model, action groups and knowledge bases are not read. |
| Status | Verified (October 2026) on AgentCore. |
| Containment | Bedrock Agents has no "disable". Not offered. |
Salesforce Agentforce
| |
|---|
| Permission (default) | An external client app using the OAuth client-credentials flow, running as a read-only integration user with API Enabled and read access to bot setup (e.g. View Setup and Configuration). |
| What it allows | Read bot definitions and their versions: name, owner, active version status. |
| Limits | Topics and actions are not read. Conversation logs depend on your licences and are not read. |
| Status | Documented. Containment (deactivating a bot version) is not offered. |
Google Vertex AI Agent Engine / Dialogflow CX
| |
|---|
| Permission (default) | A read-only service account with roles/aiplatform.viewer (Agent Engine) and roles/dialogflow.reader (Conversational Agents) on each project. |
| What it allows | List reasoning engines and conversational agents in the projects and locations you name. |
| Limits | No organisation-wide listing: each project and location must be named. Tools and data stores are not read. |
| Status | Documented. Containment not offered. |
LangGraph Server
| |
|---|
| Permission (default) | The deployment URL and an API key (or a bearer token accepted by your custom auth) with read access. |
| What it allows | List assistants on that one deployment. |
| Limits | A graph's tools are code, not something the server lists. One deployment per source. The effective control for these agents is the gateway — they are yours to point at MeetLoyd. |
| Status | Documented. |
Prisme.ai
| |
|---|
| Permission (default) | An organisation API key, or the token of an org administrator who can see every agent. |
| What it allows | List agents: name, owner, status, model as reported by the platform. |
| Status | Documented. Containment not offered. |
Limits that apply to every source
- Discovery cannot stop an agent. Our kill switch refuses calls that come through MeetLoyd. An observed agent does not call us, so it keeps running until it is stopped on its own platform.
- Removal is slow to show. An agent deleted on its platform disappears from the register after 7 days without being seen, not at the next sweep.
- One credential per source. We sweep what that credential can see; agents in other environments, projects or regions are not found until they are added.
- Sweeps are hourly. An agent created and deleted within the hour may never be seen.
The Microsoft service account is shared
The Entra and Copilot Studio sources reuse the Microsoft 365 service account stored in Tools → Secrets. If your workspace already uses it for the Microsoft 365 connector (mail, calendar, Teams), do not replace it with a discovery-only app — add Application.Read.All to the existing app instead, or the connector stops working. If it is not set yet, a dedicated read-only app is the safer choice.