Source: bob-wire c21.inventory — Inventory + Users/Devices split, from the 2026-08-31 Mark Peterson advisor call
The technology half of the c21 split: Inventory becomes all about the agents and technologies — companies → technologies → instances, rolled up. Machines, sessions, and per-user rows moved to Users / Devices; a user survives here only as a filter, arriving pre-applied via drill-through (?user=dana). Monitored vs detected-only is first-class, and accounts & licensing surface where the inference calls reveal them.
open q: does "fleet" mean the sensored devices or the whole org? These numbers count what the sensor + egress see; the Okta/Jamf denominator and coverage framing live on Users / Devices.
Companies
vendor → technology → instanceopen q: label TBD for the technology level — "AI agents" vs "harnesses" (used interchangeably on the call)Company | Technologies | Instances | Monitored | People | Tokens · 4w |
|---|---|---|---|---|---|
Anthropic claude-opus-4-6claude-sonnet-4-5 | 2 | 9 | 9 / 9 | 9 | 217M |
OpenAI gpt-5.2gpt-5.2-codex | 2 | 10 | 10 / 10 | 8 | 64M |
xAI grok-4 | 1 | 2 | 1 / 2 1 detected-only | 2 | 12M |
Google gemini-3-pro | 1 | 3 | 3 / 3 | 3 | 19M |
Nous Research hermes-4-70b | 1 | 1 | 0 / 1 1 detected-only | 1 | 2M |
25 instances across 7 technologies from 5 companies — 1 of them unattributed (rendered as a first-class row, not hidden).
Accounts & licensing
3 enterprise · 1 personal · 1 unknownEvery inference call references an account — so licensing posture is observable, per technology and per person. The ops person knows the corporate org ids; everything else is signal.
Used alongside the enterprise org on the same device (dana-mbp) — 2 of her last 5 ChatGPT sessions ran on the personal account. Personal accounts don't carry the enterprise data protections: "none of our IP goes to a personal ChatGPT account."
annotation: ghost affordance only — this cycle is observation mode (§5). Visibility first; the block control is the obvious next step, not this page's job.
Models & usage
12 weeks · fleet-wideThe drift story: Anthropic-heavy through June → the OpenAI experiment ramps gpt-5.2 from mid-July → grok-4 arrives in the last three weeks, and Hermes flickers on locally at $0 from mid-August. Tokens and dollars are both just ways of gauging the flow.
Surface
MCP servers & repos · fleet-wideMCP servers
9 distinctRepos
6 distinctComposition notes
- The split, applied (§2.1–2.2, 2.7): no machines, no sessions, no per-user rows anywhere on this page — those moved to /pages/users-devices-v1. Inventory is agents, harnesses, surface, activity, trends.
- Users as a filter, not a dimension (§2.3): ?user=dana arrives pre-applied from Users / Devices or user detail, renders as a removable chip, and narrows instance lists and surface. Any person name in an instance row applies the same filter in place — the drill path is symmetric.
- Company → technology → instance is the hero (§2.4): five vendors as organizing rows via vendorRollup(), expanding to technologies, each listing its instances (person, device, monitored, account, version, last seen). One-to-many, rolled up.
- Monitored vs detected-only is first-class (§2.5): the headline %, the per-company coverage cell, and the actionable strip all derive from monitoredStats(). Hermes on jonah-mbp and Grok on Kai's unsensored Windows box are the two detected-only rows — detected is not monitored.
- Accounts & licensing live in Inventory (§2.6, §5): posture from accountPosture(). Dana's personal ChatGPT account is deliberately unmissable; the "Block personal accounts" button is a ghost affordance annotated as future enforcement — observation mode this cycle, not an enforcement UI.
- Identity attribution isn't assumed (§6): the unattributed Codex CLI instance (org key at egress, no person, no managed device) renders as a first-class row with a "no identity" treatment, not hidden.
- Derivation ethic: every number comes from the fixture helpers (vendorRollup / monitoredStats / accountPosture / fleetTotals / allInstances / usageTrend); nothing hand-typed. The 30d person-attributed total (~293M) is deliberately below the trend's trailing 30d (~314M) — the gap rides the unattributed instance.
- Open question — label TBD: "AI agents" vs "harnesses" for the technology level. The page says "technologies" in structure and annotates rather than decides.
- Open question — fleet denominator: does fleet = sensored devices or the whole org? This page counts what the sensor/egress see and says so; the Okta/Jamf denominator belongs to Users / Devices.