PLATFORM / DISCOVERY & SHADOW AI
GovernorAI reads the telemetry, identity logs and cloud control planes you already run, and turns them into a named inventory of AI products, agents and the people reaching them. Nothing is intercepted, and nothing changes how your agents run. This is the entry point a CISO can approve with one signature.
Every source is a feed GovernorAI consumes — a forwarder posting to an ingest endpoint, a scheduled poll, or a list call against a cloud control plane. There is no return path: the only outbound write in the whole flow is the OAuth exchange that authenticates the read.
WHY THIS IS THE FIRST STEP
Discovery is a consumer of feeds. Every source below is either something your forwarder posts to an ingest endpoint, something GovernorAI polls on a schedule, or a list call against a cloud control plane. There is no agent to install in the request path and no configuration change to the systems being inventoried.
Discovery never sits between an agent and a model, or between an agent and a tool. It reads records after the fact. Your availability path is untouched.
The egress picture comes from the proxy, CASB and endpoint vendors you already deployed. GovernorAI parses what they export; it does not sniff traffic or terminate TLS.
Scheduled sources are pulled against fixed vendor hosts; SaaS and cloud sources are enumerated with list and get calls. The only outbound write in the whole path is the OAuth token exchange that authenticates the read.
Discovery produces findings and an inventory. Registering an agent, attaching a policy or quarantining anything is a separate, deliberate governance action on a different page.
A per-vendor adapter maps the native envelope into one event shape. Missing fields stay empty; no value is ever invented to fill a column.
source_vendor · principal · destination Destinations are matched host-boundary-aware against a deliberately narrow list of known AI provider domains, and gateway records are attributed from the provider they actually called.
api.openai.com → openai The subject is checked against what you have already registered. If that check cannot be answered, the event fails closed rather than being labelled shadow on a guess.
known · likely_shadow · unknown Findings carry every source channel that saw the subject, a first and last seen time, and sample events to pivot into. The estate exports as an AI-BOM.
JSON · PDF · sha256 content hash WHAT DISCOVERY ACTUALLY READS
Every source is a shipped adapter with a real parsing contract, and every source carries a posture: connected when an enabled feed exists, available when the adapter is registered and you have not wired it yet, planned when nothing ships. The surface is derived from live wiring, so it cannot claim a source the backend cannot actually ingest.
event envelope is unwrapped and indexed fields merged with host/source/sourcetype routing.records export and value query envelopes unwrapped.ddtags into user, host and env dimensions and reading the nested attributes object.records / transactions feed shape.{status, data} export envelope.Coverage is exactly the set of sources you connect — nothing is inferred about the ones you do not. Each source resolves to connected, available or planned from live wiring rather than a marketing list, and each connected feed reports healthy, stale or not configured: a feed that is enabled but has never reported is stale, because silence is not health. A coverage grid states, per source family and per contribution, whether you have a live source, a shipped source you have not connected, or a genuine gap.
Discovery is not a network product. There is no tap, no proxy and no packet inspection anywhere in it: every source is a log, an audit record or a control-plane list call that a system you already run hands over. The blind spots of those systems are therefore our blind spots too — an agent calling a model over a path that no connected source records is invisible to GovernorAI, and connecting no sources discovers nothing.
Inside a connected SaaS tenant, deciding which automations count as AI is partly a keyword judgement over names and descriptions, tuned to be broad so an operator can dismiss what does not belong rather than never see it; the n8n connector deliberately lists every workflow. The risk level attached to a discovered SaaS agent is inferred from what that platform's objects typically reach, not measured from that tenant's grants — Slack is the one connector that reads the app's real OAuth scopes. Only Salesforce and ServiceNow support a single connection that carries both discovery and governed execution; the rest are discovery-only.
Framework runtimes are registered by an operator or by the runtime itself; nothing scans your repositories or your hosts to find them. The MCP catalog is a registry of publicly published MCP servers — it never connects to an MCP server, and its behavioural dimension is not assessed yet, so it tells you what a server is, not which servers are running inside your estate. And a finding is a starting point for triage: the discovery path itself never blocks, disables or reconfigures anything. Holding a discovered subject is a separate action on a separate permission, taken deliberately, and the state machine refuses it outright on a finding that rests only on rhythm.
WHY A FINDING SAYS WHAT IT SAYS
Three destination buckets and one strictly separate behavioural bucket. Each finding stores a machine-readable reason code, a human-readable detail, the set of source channels that observed the subject, and sample event identifiers you can pivot into — so an operator can see why a row was classified the way it was rather than being asked to trust a score.
| Classification | Reason code | What it actually means |
|---|---|---|
| known | registered_in_model_registry | The AI product the subject reached is registered in your model registry. This is a match against your own inventory, not a vendor allow-list. |
| likely_shadow | ai_product_fingerprint_no_governance | The destination matched a known AI provider and no governance coverage was found for it. This is the shadow-AI row. |
| unknown | unknown_endpoint | AI-tagged signal, but the destination matched no known AI product. It needs human triage; it is not asserted to be shadow AI. |
| unknown | unmanaged_principal | The directory loaded and this person was not in it. It means "not present in the governed inventory" — deliberately not a claim that the human is unknown to the company. |
| unknown | unknown_principal | No directory is wired, or it could not be read. GovernorAI reports that it could not tell, rather than defaulting to managed. |
| suspected_autonomous_loop | cadence | A subject's event rhythm is regular enough to be machine-driven. Computed from observed timestamps only — never from prompt or model content — and carried on its own row so a rhythm signal and a destination signal can never merge into one confidence. |
Fail-closed by design: when the registry that answers "is this already governed?" cannot be read, the event is not classified at all. A shadow finding is never produced on an unanswered question.
A regular rhythm is consistent with an autonomous loop, and equally consistent with a nightly backup, a cron export or a health check. It is reported as suspected, on timing evidence alone, at a deliberately low confidence, and it is refused as the basis for registering an agent, attaching a policy or opening an approval. Below the minimum sample count nothing is emitted at all, because too little data to distinguish a loop from coincidence is not a finding.
WHAT YOU LEAVE WITH
Discovery produces four artefacts. All four are computed from live reads of first-class stores; none of them invents a row to fill a section.
Agents, the models they are associated with, the policies that govern them and the frameworks in use — exported as JSON or as a PDF, and fingerprinted with a content hash over the inventory so a post-hoc edit is detectable.
sha256 content hashEach finding keeps every source channel that observed the subject, the first and last time it was seen, its event count and a bounded set of sample events. An identity feed and an egress feed agreeing is visible as two channels, not one merged assertion.
source-vendor provenanceSource families against contributions — discovery, enrichment, attribution and prevention context. A cell is only covered when a source is genuinely connected. Available-but-not-live is partial, and nothing shippable at all is an explicit gap, never a blank.
gap · partial · coveredWhere an identity source is connected, findings roll up how many distinct principals behind them are inside your governed directory and how many are not. Where no directory is wired, the answer is unknown — and the rollup says so rather than assuming.
counts, never a single scalar// GET /api/v1/aibom/export?format=json
{
"agents": [ /* id, name, namespace, environment, models, policies */ ],
"models": [ /* registry entry, approved_by provenance */ ],
"guardrails": [ /* policies covering at least one agent */ ],
"frameworks": [ "langchain", "langgraph", "crewai", "n8n" ],
"owners": [],
"tools_mcp": [],
"data_sources":[],
"notes": [
"Ownership is honest-empty: GovernorAI records agent registrant"
" and model approver PROVENANCE, not a designated owner.",
"Tools/MCP inventory is honest-empty: no per-tenant"
" agent-to-tool binding is recorded today.",
"Guardrail coverage reflects the governance-graph projection"
" as of <timestamp> and may lag live policy assignments."
],
"content_hash": "sha256:…"
}Three sections of the AI-BOM ship empty with a written explanation instead of a plausible guess. There is no per-tenant agent-to-tool or agent-to-MCP binding recorded today, and no agent-to-data-source binding either, so those inventories are honest-empty. Ownership is empty because GovernorAI knows who registered an agent and who approved a model — that is provenance, and a registrant is not an owner. Policy coverage is read from a projection that can lag live assignments, so the export carries the as-of timestamp and tells you to confirm an ungoverned verdict after a completed refresh. An agent missing from the projection is reported as coverage-unknown, which is a different thing from ungoverned.
WHAT STARTING LOOKS LIKE
A source is registered, issued its own scoped ingest credential, and can be proved end-to-end before you point production telemetry at it.
Pick a vendor whose posture is available. The catalog only offers what the running system can genuinely ingest, so there is no configuring your way into a dead end.
no codeEach source gets its own bearer token, bound to that source and that account, and rotatable and revocable on its own. A full account API key is never handed to a forwarder.
per-source, revocableA test-ingest call runs a representative payload for that vendor through the real adapter and the real classifier, and persists nothing. A successful preview proves the exact path your live telemetry will take.
persists nothingPush vendors post to the ingest endpoint. Pull-only sources are polled on an interval, so they are not real-time and are not presented as such. Some vendors support both.
push · pull · dualNothing on this page requires a policy, an SDK in an agent, or an enforcement decision. You can run discovery, export the AI-BOM and stop there. Registering a discovered agent, attaching a policy to it, or holding it are separate governance actions you take deliberately — and the state machine refuses several of them outright when the underlying finding is only circumstantial.
IN THE PRODUCT
IN THE PRODUCT
