Discovery is necessary but not sufficient
Inventories and control towers can surface agents you did not know were running. That closes the visibility gap but not the proof gap.
Once an agent acts on systems of record, the board question becomes whether you can show the permission decision behind each access.