Skip to main content

Reference

Reference

Lookup material — field tables, enumerations, and tool catalogs. For explanations of how these fit together, see Concepts.

Team productivity API

Administrator access, retained Team roots, signed pages, and source-qualified evidence.

Project productivity

Metric definitions, canonical repository scope, membership history, and report limits.

Repository productivity API

Authorized repository selection, retained report snapshots, contributor pages and evidence.

Credential sources, identity convergence, expiration, and resetting budgets.

Supported providers

The LLM providers you can configure an upstream for, with each one's tier, wire formats, authentication, and data-handling defaults.

OpenAI-compatible vendors AIControls knows by name: endpoints, pinned hosts, and data-handling defaults.

Every field available to a CEL policy expression.

Default access policy

Per-plane outcomes and generated policy identities for requests that match no access policy.

Route and member fields, strategy options, the routes, providers and routing APIs, route grants, error codes, and configuration keys.

Workload access documents, deny lists, model selectors, compiled policy names, and the generation fence.

Binding subjects

Access Binding subject types and how referencing workloads become derived subjects.

The audit log decision enum and what each value means.

Effectiveness Dimensions

Exact definitions and formulas for every Effectiveness Leaderboard metric.

Security Events

The unified security event log — event types, meanings, and the API endpoint.

Security Finding Catalog

Every finding type with a plain-English title, why it matters, the recommended action, and its MITRE ATLAS and ATT&CK mapping.

Security Incident OCSF Mapping

How an exported incident maps to an OCSF Detection Finding, including the OCSF 1.3.0 Parquet mapping for Amazon Security Lake, MITRE techniques and what is never exported.

Sentinel Table and Rule Schema

The custom table columns and data collection rule for the Microsoft Sentinel export destination, with its limits and failure reasons.

Security Incident Tickets

What a Jira or ServiceNow ticket for an incident contains, the destination settings and the API.

The rolled-up status vocabulary, the Issue shape, and the status/health-summary endpoints.

Feature Availability

Which features are available in Nirmata-hosted (SaaS) workspaces and self-managed installations, and why Workload Trust is self-managed only.

Runtime Controls

Runtime API endpoints, the three-state capability contract, and every field on a reconciliation row.

Pod Security Fields

The Pod Security level fields that workload discovery stores and the workload API returns, and every failing check ID.

Workloads table

Columns, filters, URL parameters, and the deployment risk band rules.

Workload readiness rules

The seven rules a workload passes before it is ready to register, and what each fails.

Compiling a workload registration

What each registered intent tier compiles to, the four guardrails a registration passes through, and what is deliberately not enforceable.

Skill Indicators

The full static and behavioral indicator catalog behind skill risk scoring.

Identity Provider Fields

OIDC provider configuration and how JWT claims map to identity.

Admin MCP Server

Tools exposed by the admin MCP server.

Wire-visible MCP details that affect client compatibility (including tools/call resultType).

AIControls Data

Administrator SQL, business schema discovery, typed results, and SQL grants.

Compliance Controls

Full NIST AI RMF control category table.

Trace Attributes

Full OTLP span schema for trace export — GenAI semconv plus governance dimensions.

Cost overview API

Windows, parameters, response fields, section status, caching, and authorization for the Cost overview endpoints.

Model pricing API

Preview and apply a saved model price to past requests priced at the fallback rate: fields, window rules, idempotency, audit entry, and authorization.

Session cap API

Preview and apply a changed default session cap to existing sessions: scopes, selection rules, idempotency, audit entry, and authorization.

Entitlements API

Plan, add-ons, feature states, limits and usage, who can read each, and the 402 response.

Upgrade prompts API

Admin-only upgrade prompts: endpoints, triggers, how often a prompt appears, and dismissal.

Security overview API

Parameters, scope filters, section status and reason values, caching, and authorization for the Home Security overview endpoint.

Self-Hosted Kubernetes

Deploy AIControls in your own cluster — Helm chart, OIDC identity, and agent configuration.