Discovery is where you connect the platforms your AI runs on so their agents and models are found and pulled into the registries, instead of registering each one by hand.
Overview
Each row in Discovery is a Connection, with columns Connection (the connection's name), Platform (logo and name), Connection type (Observe · Advisory or Control · Enforced), Discovered (how many agents or models it found, like "3 agents"), Workspace (in the all-workspaces view), Status, Owner, Last updated, and Last synced. You connect a platform once, review what the sweep found, and register the assets you want governed. A row's only action is Delete (the confirmation names the connection); clicking a row opens the connection's detail page.
Empty state: "No connections yet" — "Connect a platform to sync its agents and models into the registry." — with an Add Application button.
Connecting a Platform
Add Application — "Connect a platform to discover agents and models" — is a two-step drawer:
Pick a platform. The discovery-capable platforms today: AWS Bedrock, Anthropic (Managed Agents), Core42 Compass, Crowdstrike AIDR, Databricks (REST APIs), Microsoft Copilot, n8n, OpenAI, Salesforce, ServiceNow, Snowflake, UnifyApps, and Workato. SDK frameworks like LangChain aren't here — those agents are registered manually instead.
Select a connection. Pick an existing, active connection for that platform, or use New to create one here (you need permission to create connections for that app). If the platform has no connections yet, you'll see "No connections found" with a New Connection button. A Connection type section — "Governance tier applied to every agent through this connection." — shows two tiers: Observe · Advisory ("Monitors, evaluates, flags, but cannot block calls in real time.") and Control · Enforced ("Can block, redact, mask and require approval."). Control can be chosen only for platforms that support it — n8n, among the discovery platforms. For every other platform, Control is greyed out with the tooltip "This platform can't route calls through the gateway yet, so it can only be observed." and the connection is created in Observe mode.
Connect creates the connection entry and starts its first sweep. If that connection was already added, you're simply taken to its existing page (one connection = one Discovery row, always). A real failure shows "Couldn't connect the platform" and keeps the drawer open.
What Happens During and After the First Sync
The new connection's detail page shows "Initial sync in progress" — "This connection is being synced for the first time. This can take a while for large sources." — and checks for completion every few seconds; the header's actions are hidden until it finishes. The sweep asks the platform for its agents (or, for OpenAI and Core42, its models) and creates one registry entry per asset, unregistered by default. When the sweep completes, the Assets table fills in.
Note: A connection is swept only when it's created and when you press Sync Now — despite the Sync interval setting, no automatic re-sync schedule is active today, so newly added agents on the platform won't appear until a manual sync. Re-running a sweep never un-registers anything — it only adds or updates.
A Connection's Detail Page
The header shows the connection's name, its platform, a Settings gear, and a Sync Now button (with a spinner while a sync runs). Below it, Assets lists everything discovered through this connection:
Column / control | What it shows |
|---|---|
Register toggle | Per row — flips the asset into or out of governance. |
Asset name | The agent or model's name on the source platform. |
Asset type | Agent or Model. |
Status | Excluded (deliberately left out), Setup Pending (registered but no data yet), or Active. |
Owner / Last updated | Standard metadata columns. |
Clicking a row opens that asset in the Agent Registry (or Model Registry for models). When assets have been discovered and none are registered yet, a banner reads "{n} assets discovered" — "Register them to bring this connection's assets under governance." — with Register All and Dismiss. The banner disappears once anything is registered; Dismiss hides it in your browser only (teammates still see it).
Registering a Discovered Asset
Flipping Register on brings the asset under governance — it appears in the Agent or Model Registry and can be added to policies. Flipping it off marks the asset Excluded: it drops out of the registry and out of policy pickers, though it stays listed here for later.
Note: Avoid also registering the same asset manually through Register Agent — that can create a second, separate entry.
The first registration also starts the platform's data ingestion for that asset: for most connected platforms the platform is polled about every 15 minutes for new activity, picking up where the last poll stopped. Three things to know:
Ingestion starts once, on first registration — switching Register off and on again later doesn't restart it.
If polling fails several times in a row, ingestion for that asset stops and doesn't resume by itself — if an asset's data stops flowing, contact support rather than re-toggling.
Platforms differ: Salesforce pushes its trace data to UnifyApps rather than being polled, and some listed platforms don't have an ingestion path wired up yet — an asset can register cleanly and still never show activity. Treat a dataless registered asset as a platform-coverage question for support.
Deleting a Connection
Deleting a Discovery connection removes this row and stops its sweeps. Assets that were already registered through it stay in the registries — deletion here doesn't unregister them. To take assets out of governance, use their Register toggles or delete them from the registries.
Sync Settings
The Settings gear opens a small dialog:
Setting | Behavior |
|---|---|
Sync interval | Every hour, Daily, or Weekly. Saved as a preference, but no automatic re-sync runs from it today — use Sync Now to refresh a connection. |
Auto-register agents | "Add newly discovered agents to the registry automatically." Off by default. Applies to newly discovered assets only — turning it on doesn't register assets that were already discovered and excluded. |
Connection Statuses
The list's Status column shows Connected, Paused, or Sync Error. A connection shows Sync Error when its last discovery sweep failed. Nothing pauses a connection today.
Note: When a sweep fails, the connection's detail page shows Sync failed with the error the platform returned (or "We couldn't sync this connection. Check the connection settings, then try syncing again.") and a Try again button. If a sweep succeeds but returns nothing and you suspect a credentials problem, verify the connection's health in the Connections module and run Sync Now again.
The Same Agent Appears Twice — Why?
Discovery deduplicates within a connection: re-syncing the same connection updates the existing entries. But if the same underlying agent is reachable through two different connections, each connection's sweep creates its own registry entry — they aren't merged.
Note: Prefer connecting one canonical connection per platform to avoid doubled entries.