Security Posture
AIControls provides a real-time view of risk across your AI estate — computed risk scores per identity, NIST AI RMF compliance mapping, a policy exception workflow, and a human-in-the-loop approval queue.
Risk scores
Navigate to Security → Posture for an org-wide risk summary. The page shows computed risk scores per agent and developer, derived from violation rate, HITL rate, blast radius, and write-tool breadth over the last 7 days. Use it to identify which identities warrant closer review and to track posture trends over time.
Posture is informed by behavioral baselines. AIControls builds a per-identity baseline (normal call rate, typical token volume, common tools) over time. Deviations from that baseline surface in the Detections feed and raise the identity's risk score.
Detections
Navigate to Security → Detections to view session anomalies and baseline alerts in one place. Session anomalies are fired when a behavioral threshold (call rate, token spike, repeated prompts) is crossed. Baseline alerts are generated by policy violations, budget threshold crossings, and HITL events.
Detections is covered in depth on its own page — session anomaly detection, thresholds, auto-pause, tuning for agentic workloads, baseline alerts, and delivery channels.
Compliance
The Compliance page maps your active policies and capabilities to the NIST AI Risk Management Framework (AI RMF), reporting covered, partial, and missing controls in real time. Export an audit-ready report for security reviews and regulatory submissions.
Exceptions
Navigate to Security → Exceptions to manage temporary policy overrides. An exception allows a specific identity or group to bypass one or more policies for a defined period — useful for contractor onboarding, one-off experiments, or incident response.
Each exception records who granted it, the justification, and an expiry time. Expired exceptions are automatically revoked and appear in the audit log. Active exceptions are visible to all admins on the Exceptions page.
Approvals
Navigate to Security → Approvals for the human-in-the-loop (HITL) queue. When a policy routes a request for approval rather than denying it outright, the request lands here. Admins can approve or deny each request; the developer's session is held until a decision is made or the request times out.
HITL is configured per policy rule — set the enforcement mode to approval in any ValidatingPolicy to route matching requests here instead of blocking them outright. This is useful for high-risk but infrequent operations (production deployments, credential access) where context matters.
Approval requests expire after a configurable timeout (default: 30 minutes). If no admin acts within the window, the request is auto-denied and the developer receives a timeout message.
The Approvals card on the Posture page also reports decision time — the p50/p90 time from request to decision, computed only over requests an admin has already decided. This is a different measurement from the "avg wait" figure shown for the pending queue: avg wait is how long currently pending requests have been sitting, which keeps changing as time passes; decision time is a fixed, backward-looking measurement of how fast your team actually responds once a request lands. A slow decision time despite a low pending count usually means requests are getting decided, just not quickly — worth investigating separately from queue depth.
Quiet confidence
The stat row also surfaces Quiet confidence — the percentage of call dispositions over the selected period that resolved with zero human involvement (Allow, Mutated, Cache Hit, Audit, Allowed by Exception), out of all dispositions including the human-involved ones (Deny — which also covers egress denials — Warn Approve, Warn Ask). A high quiet-confidence score means your policies are doing the enforcement work autonomously; a falling score means more calls are landing on a human queue — check Approvals and Detections for the cause. See Decision Types for the exact set definitions.