Inventory
Nobody knows how many agents there are
Custom GPTs, projects, connectors and code agents appear without a record. The last survey is already wrong.
Observe · Compliance teams
Answer the three questions
an auditor will ask.
What AI is in use? What can it reach? Who owns each agent? Lustena keeps the inventory, the limits and the decision history current, and exports an evidence package mapped to GDPR, the EU AI Act, ISO/IEC 42001, NIST AI RMF, AIUC-1 and LGPD.
Compliance evidence is scattered across documents, spreadsheets and inboxes
The AI policy is a document, the inventory is a spreadsheet, the approvals are in email. None of them is current when the questionnaire arrives.
Decisions
Approvals have no history
Who allowed the sales GPT to read the CRM, when, and under which limit? The answer is an email thread, if it exists.
Lawful basis
Monitoring without a basis is a liability
Reading employee prompts to protect data creates a privacy problem of its own. Evidence has to be content-free by default.
One inventory of declared and observed agents
Each agent carries an owner, a team, a purpose, its connectors, its limit and its findings. Declared and observed stay distinct, so the gap is visible instead of hidden.
Production2026-10-14 · 02:41:07Z
Agents
Every agent this workspace knows about, declared by a person or observed in use, with its owner and connectors.
Inventory · 5 rows
| Agent | Owner · connectors | Status |
|---|---|---|
| GPT · Proposalsana@acme.com | ana@acme.comGmail, Drive | Declared |
| Claude · Finance projectjoao@acme.com | joao@acme.comSheets | Observed |
| Support bot (LangGraph)platform team | platform teamZendesk API | Declared |
| Copilot Studio · HR FAQunknown | unknownSharePoint | Observed |
| Claude Code · repo-assistengineering | engineeringMCP: GitHub | Declared |
Selected · GPT · Proposals
Owner
ana@acme.com · Marketing
Limits
v3 · tools, hosts, data
Last seen
2m ago · chatgpt.com
Limits with a decision history
Every limit is versioned with who changed what and when. Alerts record the dimension crossed, the observed value and the allowed one. This is the decision record ISO 42001 asks for.
ProductionGPT · Proposals · owner ana@acme.com
Limit history
Every change is a new version, attributed and dated. Previous versions stay readable.
Versions · 3
- v3data classes: none personalana@acme.com · Oct 12current
- v2hosts: + api.hubspot.comrafa@acme.com · Sep 22replaced
- v1created · tools, MCP servers, hostsrafa@acme.com · Sep 3replaced
Alerts · limit v3 · 24h
data class: personal · observed 3 × card number · allowed: none
paste · chatgpt.com · Oct 14 · 02:41 · webhook → #sec-alerts
Evidence that respects GDPR and LGPD by construction
Findings are content-free by default. Redacted capture is opt-in, requires a written lawful basis and a retention period, is encrypted at rest and audited on every read. The evidence package maps all of it to the frameworks you name.
ProductionQ4 2026 · workspace acme
Evidence package
One document for your auditor, mapped to GDPR, EU AI Act, ISO/IEC 42001, AIUC-1.
Contents · 5 sections
| Section | GDPR | AI Act | 42001 | AIUC-1 |
|---|---|---|---|---|
| Inventory with owners14 agents · 5 teams | ||||
| Limits and versions9 limits · 23 versions | ||||
| Findings with lifecycle29 open · 112 closed | ||||
| Scan reports4 endpoints · OWASP LLM Top 10 | ||||
| Decisions37 changes, attributed |
Redacted capture · Marketing
lawful basis: recorded · retention 180d · reads audited
findings: content-free by default · values replaced by category
Questions
Which frameworks does the evidence package map to?
GDPR, the EU AI Act, ISO/IEC 42001, NIST AI RMF, AIUC-1 and LGPD today. Named standards are references; Lustena prepares the evidence, independent assessors certify, and Lustena does not issue certifications.
Does Lustena store employee prompts?
Not by default. Opt-in redacted capture stores text with every detected value replaced by its category, with a lawful basis recorded and every read audited.
Can I export the inventory?
Yes. The evidence package includes the inventory, limits, findings and decisions, and is shared with your auditor as one document.