Inventory + Users / Devices

Qpoint's roadmap conversation with fractional CISO advisor Mark Peterson (2026-08-31) surfaced a critical refinement to the c16 agent-control-plane work: the current agent inventory conflates two distinct analytical lenses that need separation.

Security leaders universally prioritize agent/technology inventory (what tools are deployed, who's using them, coverage gaps) before governance work begins. But bundling agents + machines + users into a single page obscures the personnel/identity layer — integration with MDM systems, per-user AI usage patterns, token/spend tracking, and deployment coverage by endpoint.

Mark's framing: inventory is the entry wedge, but it must split into two surfaces: Inventory (agent + technology rollup, company-level aggregation, monitored vs unmonitored, licensing model enforcement) and Users / Devices (people-focused identity integration, per-user usage, tokens/dollars, endpoint deployment completeness). The split unblocks both the agent-governance journey and a parallel identity/compliance story.

Deliver two refined wireframe pages — Inventory and Users / Devices — anchored on qcontrol's real product state, grounded in the Mark Peterson call's roadmap input, and ready for hi-fi mockup iteration.

Inventory page: Agent and technology rollup organized by company (consolidating Anthropic as superset of its agents), showing monitored vs unmonitored deployment, usage trends, and licensing model (personal vs enterprise) with enforcement signals (e.g., blocking personal accounts per the data-protection use case).

Users / Devices page: People-focused dashboard integrated with identity management systems (MDM source of truth), surfacing per-user AI usage patterns, token/dollar spend, deployment coverage (who has sensor installed), and accountability signals.

• cycles/c21.inventory/initial-prompt.md — Mark's notes and roadmap framing
• cycles/c21.inventory/design-brief.md — human-facing design brief (call decisions, page stories, open questions)
• cycles/c21.inventory/technical-plan.md — AI-execution plan (pages, data shapes, phases)
• cycles/c21.inventory/briefs/ — feature briefs, if any are split out for /wireframe
• app/pages/c21/wireframes/wf1/inventory-v1/ — Inventory and Users/Devices lo-fi pages
• app/data/wireframe-registry.ts — register both pages as type: 'wireframe', iteration: 'wf1'
• Reference material: Mark Peterson call data at ../market-analyst/data/processed/38075ead-4294-428f-bb58-13898dad7160.json, c16 control-plane conventions

Out of Scope

• Changes to qcontrol app, ../app.qpoint.io, or ../q-nuxt-layer
• Real data, API calls, auth (fixtures only)
• Hi-fi mockups (m1 pass deferred to follow-on)

m1 pages built in design /pages (2026-09-01): All three mocks built and registered in design's page registry (inventory / teams groups): inventory-companies-v1 (company→technology→instance rollup, detected-only strip, accounts & licensing with the personal-ChatGPT standout + ghost "block personal accounts" affordance, 12-week model-drift trends, surface directories, ?user= filter chip), users-devices-v1 (coverage vs Okta/Jamf denominator with the Alexis investigate callout and macOS-only Windows gap, 15-person DataTable roster with tokens⇄$ toggle and LLM summaries, attribution-debt band), user-detail-v1 (device↔identity↔agent chain, flagged personal-account sessions, person switcher over Dana/Kamal/Jonah/Alexis states). Shared fixtures c21-inventory-fixtures.ts — every number derived, story beats verified by execution. Cross-links: users-devices → user-detail (?person=) → inventory (?user=) → back.

Mockups go hi-fi-first, cross-repo in design (2026-09-01): Mark chose to skip the bob-wire wf1 wireframe pass and build hi-fi mockups directly in ../design app/pages/pages/ (flat versioned mocks, real layer components, page-registry groups) — that's where the current qcontrol design language lives and where the c21 ancestors sit (design c59 inventory, c67 teams, c78 fleet-overview-reports from the same Mark Peterson engagement). Three pages: inventory-companies-v1 (technology view), users-devices-v1 (people view), user-detail-v1 (drill + sessions), on shared fixtures app/data/c21-inventory-fixtures.ts. The c21 Fleet Overview page is dropped — design c78's fleet-overview-v3 owns that thread; c21 widget ideas feed it rather than fork it. bob-wire keeps cycle records, design brief, and technical plan as source of truth.

Inventory scaffold & Mark Peterson call input (2026-08-31): Cycle created from Mark Peterson fractional-CISO advisor call (roadmap-planning session, 2026-08-31, call data at ../market-analyst/data/processed/38075ead-4294-428f-bb58-13898dad7160.json). Split c16's agent inventory into two focused surfaces: Inventory (agent/technology rollup, company consolidation, licensing enforcement, monitored coverage) and Users/Devices (identity-integrated, per-user AI usage, tokens/spend, MDM deployment coverage). Initial prompt and notes captured in initial-prompt.md. Design brief and technical plan being drafted separately.