Introduction

Adding an application points Discovery at a platform that hosts AI assets, so it can sweep that platform and return the agents and models running on it.

The step that surprises people: you choose a connection rather than typing credentials. Pick an existing connection, or click New (Add new connection when the list is empty) to create one in place.

Where to find it

AI Governance > Discovery > + Add Application

Access to AI Governance is granted through platform roles. Ask your workspace administrator, or see Settings > Governance > Roles for how permissions are assigned.

Before you begin

1. Have a connection, or permission to create one — Discovery sweeps a connection. If none exists you can create it inside the flow with New, which needs Connection create permission — see Create a Connection.

2. Confirm the platform is supported — Check the Supported Providers Matrix. The platforms available for Discovery differ from the ones available for manual agent registration.

3. Decide the governance tier — You set Connection type during this flow, and it applies to every asset the connection returns. Read Connection Types first.

4. Add it from the right account — The connection's owner is the person who adds it; there is no owner field in Add Application.

Add the application

Step 1: Open Discovery

Navigate to AI Governance > Discovery. The table lists every connection already under governance, with the count beside the page title.

Step 2: Click + Add Application

A panel opens on the right, titled Add application, with the subtitle Connect a platform to discover agents and models.

Step 3: Choose the platform

The panel lists every platform Discovery supports, alphabetically, with a search box above it. Select the one you want to sweep.

Only supported platforms appear — there is no greyed-out entry for a platform that cannot be swept. If yours is missing, it cannot be discovered today; register its agents manually instead.

Step 4: Choose the connection type

The panel becomes Select a connection for <Platform>. The first field is Connection type — the governance tier applied to every agent reached through this connection.

1. Observe · Advisory — Monitors, evaluates and flags, but cannot block calls in real time.

2. Control · Enforced — Can block and mask a call before it completes.

Observe · Advisory is selected by default. For UnifyApps and n8n you can choose Control · Enforced instead; for every other platform Control is disabled with the tooltip "This platform can't route calls through the gateway yet, so it can only be observed.". See Connection Types for what that means for enforcement.

Step 5: Choose the connection to sweep

Below the tier, the Connection field lists the active connections for that platform, each with its Created on date. Search by name and select one, or click New to create one in place.

If the list is empty, click Add new connection to create one without leaving the panel.

Step 6: Connect

Click Connect. Use Back to return to the platform list, or Cancel to close without saving.

Result

Clicking Connect takes you to the connection's page while the first sweep runs. If setup fails you see Couldn't connect the platform — that means the setup automation failed, not that the platform was unreachable.

The page shows Initial sync in progress until the first sweep finishes — large sources take a while. Once it finishes, DISCOVERED on the Discovery row shows what came back, by asset type.

The connection's Assets table lists the agents and models the sweep found. They are discovered, not yet registered — a banner reading N assets discovered invites you to Register All, and registering is what actually brings them under governance. See Working with Discovered Agents.

Set the sync schedule

Open the connection and use Settings to control how often it re-sweeps.

1. Sync interval — Every hour, Daily or Weekly. Match it to how quickly agents appear on that platform, not to how often you want to look.

2. Auto-register agents — Off by default. On, newly discovered agents are added to the registry automatically. Useful once you know what a platform holds; on a first sweep it removes the review step that makes the inventory worth having.

Sync Now — in the connection page header — forces a sweep without waiting.

Important considerations

1. The tier applies to the whole connection — Connection type is set per connection, not per agent. Every asset that connection returns inherits it.

2. Adding the same connection twice serves no purpose — One connection, swept once. To cover a second account or environment, create a second connection on the platform side and add that.

3. Two connection statuses — Connected is healthy. Sync Error means the last sweep failed — check the credentials behind the connection first.

4. A connection can return nothing — DISCOVERED showing a dash means the sweep completed without returning assets — commonly because the account genuinely hosts none, or because the credentials behind the connection lack permission to list them.

5. The row menu has one action — Delete. Sync Now is in the connection page header. There is no edit-in-place for the connection type; to change the tier, delete the connection and add it again.