Introduction

End to end in about fifteen minutes: connect a platform, register an agent, put a policy on it, and read the first incident it raises.

The point is not coverage. It is to see the whole chain work once on something real, so the rest of the module stops being abstract.

Before you begin

1. A connection to a platform that hosts agents — Discovery sweeps a connection your tenant holds. If none exists, click New in the connection step to create one without leaving the drawer (this needs Connection create permission). See Create a Connection.

2. An agent with some traffic — An agent that has never run produces no traces, and therefore no incidents to read at the end.

3. Fifteen minutes you will not be interrupted in — The last step involves waiting for real traffic.

Step 1: Connect a platform

Go to AI Governance > Discovery and click + Add Application.

Pick your platform, leave Connection type on Observe · Advisory, choose the connection to sweep, and click Connect.

Clicking Connect opens the new connection's page, which shows Initial sync in progress until the first sweep finishes.

Step 2: Read what came back

You are already on the connection's page. Large sources take a while to sweep.

When it finishes, the Assets table lists what the platform hosts. Stop and read this. The count, and the names, are usually the most interesting thing you will see all week.

Everything here is Excluded — discovered, not governed.

Step 3: Register one agent

Pick an agent with real traffic and toggle REGISTER on. Resist Register All for now; you want one agent you understand, not a full registry.

It appears in the Agent Registry. Its Owner is set when the agent is registered — a discovered agent takes the person who created the connection — and it cannot be changed from the agent page afterwards. Incidents are not routed automatically: assign them from the Incidents list.

If it reads Setup Pending, no traces have arrived yet. Its Setup tab tells you what it is waiting for.

Step 4: Apply a policy

Go to AI Governance > Policies > System Policies. Pick a framework pack — they arrive already populated with controls, which is why this is faster than authoring your own. The System Policies tab is shown only to users with the STANDARD permission; if you see only one list, ask your administrator.

Open it, go to Applies to, click Add assets, and select the agent you just registered. Hand-pick it rather than writing a rule: you want exactly one agent covered.

The policy's APPLIES TO count becomes 1. Its controls now evaluate that agent's traffic.

Step 5: Read the first incident

Let the agent handle real traffic, then go to Incidents and filter to your agent.

Open one. It names the content that matched, the control that caught it, the policy that delivered that control, and the action taken. Follow it through to the conversation it came from.

Then ask the question the whole module exists for: was that right?

1. Yes — Mark it Resolved. Governance is working.

2. No — Mark it False positive — honestly, not as Resolved. That status is the only signal that tells you which controls need tuning.

Result

You have run the whole chain once: a connection sweeping a platform, an agent registered and owned, a policy covering it, and an incident you have judged.

Everything else in AI Governance is this, at scale — more platforms, more assets, rules instead of hand-picking, and the measurement layer on top.

What to do next

1. Register the rest of that connection — Now that you know what its incidents look like. Register Discovered Agents.

2. Tune before you widen — If your one agent produced a lot of noise, ten will produce ten times as much. Tuning Policy Noise.

3. Grade the controls — Blank severities make a queue unsortable. Severity.

4. Switch to rules — Once tuned, cover by rule so new agents are governed as they appear. Apply a Policy to Assets.

Troubleshooting

The sweep returned nothing. The connection's credentials probably cannot list agents on that platform. Discovery sees exactly what that identity sees.

My agent shows 0 traces. It has not run since it came under governance, or it is not instrumented. Check its Setup tab.

No incidents after an hour. Either the agent has had no traffic, or nothing matched. Both are fine. Check LAST TRACE to tell which.

A Block control did not block anything. Expected on an Observe · Advisory connection. The violation is recorded, not prevented.