Introduction

Discovery finds the AI assets already running in your organisation. You point it at a platform you already use — Microsoft Copilot, AWS Bedrock, Salesforce — and it returns the agents and models that platform is hosting, including the ones nobody told IT about.

This is the first step in governing AI, and it runs before anyone registers anything by hand. Most organisations find more agents than they expected.

"You cannot govern an agent you do not know exists. Discovery is how you find the ones nobody registered."

Where to find it

AI Governance > Discovery

Access to AI Governance is granted through platform roles. Ask your workspace administrator, or see Settings > Governance > Roles for how permissions are assigned.

What Discovery finds

Discovery is not limited to agents. One connection can return more than one kind of asset, and each kind flows into its own registry.

1. Agents — AI agents deployed on the connected platform, whether or not they were built in UnifyApps. Discovered agents appear in the Agent Registry.

2. Models — The models the platform exposes. A single model-provider connection commonly returns well over a hundred. Discovered models appear in the Model Registry.

Because a connection can return either or both, the DISCOVERED column names what the last sweep actually returned — 16 agents on one connection, 132 models on another.

Connections, not platforms

Discovery operates on connections, not platforms. One platform can have many connections, each pointing at a different account, tenant or environment, and each is swept, owned and audited separately.

Two connections to the same platform pointing at two different accounts are two rows in Discovery, with their own owners and their own asset counts. Plan them the way you would plan service accounts.

A second consequence matters when you set one up: Discovery does not ask you for credentials. It reuses a connection that already exists in your tenant. You choose which existing connection to sweep. See Add an Application.

How agent identification works

Discovery does not guess. For each connected platform, UnifyApps calls that platform's own list-agents API and reads the asset-type metadata the platform returns. Identification is native to the provider's API rather than inferred from naming patterns.

This is why coverage varies by platform, and why new platforms can be added quickly — the connector layer already speaks these APIs.

Refer: For the full mechanism, including what happens on a platform that exposes no list API, read How Agent Identification Works.

Observe or control

Finding an asset and being able to act on it are two different things. Every connection carries a CONNECTION TYPE that tells you which you have.

1. Observe · Advisory — Out-of-band telemetry. UnifyApps monitors, evaluates and flags, but cannot block a call in real time. Violations are recorded after the fact and raised as incidents.

2. Control · Enforced — An inline gateway that can block, mask and require approval before a call completes.

Today every connection you create is Observe · Advisory. Read Connection Types before you plan enforcement — it sets out exactly what is available now and what is not.

The Discovery table

Each row is one connection. The count beside the page title is the number of connections configured.

1. CONNECTION — The name of the connection being swept. Name it for the account or environment it points at — the platform already has its own column.

2. PLATFORM — The system being scanned.

3. CONNECTION TYPE — The governance tier applied to every asset found through this connection.

4. DISCOVERED — What the last sweep returned, by asset type — for example 10 agents or 132 models. A dash means the sweep has not returned assets.

5. WORKSPACE — The workspace the connection's assets belong to.

6. STATUS — Connected (syncing normally) or Sync Error (the last sweep failed).

7. LAST SYNCED — When the connection last completed a sweep. Read this rather than LAST UPDATED when you are asking how current the inventory is.

8. OWNER — Who is accountable for the connection.

9. LAST UPDATED — When the connection record last changed.

The table carries the standard controls — Filter, Sort, Search, and a hidden-columns control that tells you how many columns are currently hidden. Each row's menu has one action, Delete.

Search matches the connection name only, and the list is sorted by Last updated, newest first. Re-adding a connection that has already been swept opens the existing one.

Opening a connection

Click a connection to open it. The detail view is where the sweep's results actually live, and where most of the work happens.

1. Assets — The agents and models discovered through this connection, with an ASSET TYPE of Agent or Model, and a REGISTER toggle on each row.

2. Register All — A banner reading N assets discovered offers to register everything the sweep returned in one action.

3. Sync Now — In the connection page header; forces a re-sweep without waiting for the schedule.

4. Settings — Sync interval — Every hour, Daily or Weekly — and Auto-register agents, which adds newly discovered agents to the registry automatically. Off by default.

On a first sweep, Initial sync in progress appears while the connection is being read for the first time. Large sources take a while.

What Discovery does not do

1. Discovery does not govern — Registering an asset brings it into a registry. Policy is applied separately, in Policies.

2. Discovery does not create credentials — It sweeps a connection that already exists in your tenant. Create the connection first — see Create a Connection.

3. Discovery does not change the assets it finds — Sweeping is a read. It does not modify an agent, its configuration, or what it can reach.

Best Practices

1. Sweep before you register anything by hand — Manual registration is for platforms with no connector. Starting there duplicates work the sweep would have done, and misses what you did not think to look for.

2. One connection per account or environment — Separate connections give you separate owners, separate sweeps and a clean audit trail. A single shared connection across environments gives you none of those.

3. Name connections for what they point at — Production — EU tenant tells the next person something. Test 3 does not.

4. Add connections from the right account — The person who creates a connection becomes its owner, and it cannot be changed in the UI.

5. Read the first sweep before you act on it — The initial inventory is usually the most informative artefact in the whole exercise. Read it before you start applying policy.