Skip to main content

Tasks

Tasks

Step-by-step instructions for common jobs. For background on how a feature works before you configure it, see Concepts.

For autonomous agents in your own Kubernetes cluster, see Set up Microsoft Entra agent identity. This is separate from human SSO and uses native agent identities and application permissions.

View Project productivity

Select repositories and contributors, compare delivery trends, and inspect supporting evidence.

Connecting AI Tools

Connect Claude Code, Claude Desktop, Cursor, OpenAI Codex, or GitHub Copilot through AIControls.

Connect an LLM provider and its credential.

Send a set of models to an ordered list of providers, with a strategy and failover.

Steer a Team Through a Route

Name a route on an Access Binding grant so one team reaches different providers.

Route a Model Alias

Give one model name to a route, with a different model per member.

Monitor System Health

Read the rolled-up status, drill into upstreams, gateway, services and runtime.

Author a CEL policy that matches tool calls or LLM requests.

Set the default access policy

Choose how unmatched MCP, LLM, and outbound HTTP requests are allowed, held, or denied.

Install a Policy Pack

Install a curated set of policies for anomaly detection, egress, approvals, content safety, cost, model access, or MCP tool access.

Assign Autonomy Tiers

Set an agent's T1–T4 autonomy tier from the UI or the API.

Cost Governance

Set a budget and reduce spend with context optimization.

Security & Compliance

Tune detection thresholds, govern skill risk, restrict network egress, and generate a compliance report.

Triage a Security Incident

Assign, acknowledge and resolve correlated incidents with a disposition and a note.

Suppress Noisy Security Incidents

Hide a known-noisy pattern for a limited time, with a reason, and revoke it later.

Export the Security Triage Record

Download incident triage actions and suppression rules for a SOX, HIPAA or DORA review.

Contain an Agent from an Incident

Revoke an agent's access from an incident, see what it cuts off, and restore it from the identity page.

Choose Models for Internal AI Features

Give summaries, the attack-pattern Judge and the AI Analyst each the model they need, and keep Judge downgrades honest.

Enable the Injection Classifier

Deploy the optional ML-based prompt-injection classifier sidecar and calibrate it against your own traffic before enforcing on it.

Validate LLM Responses

Write a response-phase policy to scan or block outbound LLM and MCP tool text, including streaming replies.

Configure an External Guardrail

Point content-safety scanning at your own HTTP classifier and map its response onto AIControls' finding types.

Restrict Network Egress

Limit which domains MCP tool traffic may reach, with scoped rules and exceptions.

Approve or Deny a Request

Decide on exception, model-access, and budget top-up requests, including multi-approver co-sign, and revoke a grant.

Request an Exception Inline

Ask for a time-boxed exception without leaving your AI tool — reply to the denial, use a governance tool, or run /request-exception.

Request a Config-Target Exception

Request and approve a time-bounded exception against a budget cap or an egress allowlist.

Connect an MCP Server

Register and authenticate an MCP server with AIControls.

Enable Network Egress Filtering

Generate a CA, configure the egress proxy, and write your first egress policy.

Enable Runtime Controls

Install the Kyverno runtime sensor, turn on kernel-level observation, and verify coverage. Self-hosted Kubernetes only.

Export Workload Compliance Evidence

Download one workload's governance scorecard and posture evidence, mapped to the EU AI Act and the OWASP Top 10 for Agentic Applications.

Review Kubernetes Posture

Read the posture screens, check how fresh the evidence is, and choose which Kyverno policies count. Self-hosted Kubernetes only.

Register a Workload

Declare what an AI workload is for and what it touches, in under five minutes — through the intake form or an API push.

Bind a Workload Identity

Tie a registered workload to the one ServiceAccount whose calls AIControls authorizes.

Switch a Workload to Enforce

Preview the calls that Enforce would block, switch a registered workload to Enforce, and switch it back to Audit.

Review and Restore a Binding Change

Edit an Access Binding or Runtime Binding, review the impact on every workload, and restore an earlier revision from its history.

Edit a Workload Blueprint

Create a Blueprint with a Purpose, a profile, one Access Binding, and one Runtime Binding, or edit one and review the impact on its workloads.

Grant a Group of Workloads a Shared Access Binding

Select one Access Binding in several Blueprints, and change its grants for every workload at once after an impact preview.

Promote a Recommendation

Turn a workload's unmatched call into a grant in its own Access Binding, preview exactly what changes, and dismiss what you don't want.

Turn a Workload's Learned Access into a Blueprint

Create a Blueprint from a workload, select or create its two bindings, keep the workload's access unchanged, then register similar workloads.

Deny a Grant for One Workload

Narrow a legacy or shared Access Binding grant for one workload from its AI access tab, preview the result, and commit it in one audited write.

Configure the Workload Trust Policy

Bind workload intent tiers to the Services, paths, and interpreters they stand for in your cluster.

Make a Workload Ready to Register

Fix each failing readiness rule, from Pod Security to traffic routing, so the workload reads Ready to register.

Register Workloads Automatically

Let developers opt a ready workload in with a label. AIControls registers it in Audit mode.

Protect OpenShell Sandboxes

Discover OpenShell sandboxes, register them automatically in Audit mode, and switch them to Enforce.

Draft a Policy from Observation

Turn what a workload was observed doing into a reviewable RuntimePolicy draft, with every line linked to its evidence — for workloads nobody controls the build of.

Enable Enforcement for a Workload

Review what enforcement would block, record the authenticated enablement, and verify that controls become active and hold.

Arm a Workload Kill Switch

Stop a registered workload's network, file system and exec, or gateway activity for a limited time, then disarm it.

Admin Console SSO

Turn on admin console sign-in through the same identity provider you already use for the developer portal and AI clients.

Link Your Enterprise Identity

Enable Cross-App Access for PAT-authenticated tools like Claude Code.

Create a Team Access Binding

Map an IdP team to one or more MCP servers.

Manage access by team

Layer a few shared Access Bindings to give several teams the access they need.

Control MCP Tool Access

Grant or deny individual tools per team, user, or agent — with conditions and default-deny.

Manage Toolsets

Curate reusable tool sets across servers and attach them to bindings.

Rate-Limit MCP Tools

Cap tool call rates per user, agent, or team — deny or warn on exceed.

Configure webhook, Slack, Teams, S3 export, Jira or ServiceNow tickets, or Okta agent setup.

Export Security Incidents

Send an incident to Splunk, any webhook, Amazon Security Lake or Microsoft Sentinel as an OCSF Detection Finding.

Export to Microsoft Sentinel

Send incidents to a Sentinel table through the Logs Ingestion API, with a Microsoft Entra app registration.

Export to Amazon Security Lake

Write incidents to a Security Lake custom source as OCSF Parquet, with an assumed role and external ID.

Create Security Incident Tickets

Create a Jira or ServiceNow ticket for an incident, manually or automatically for critical incidents.

Review Configuration Audit

Find who changed configuration, inspect recorded changes, and investigate failed saves.

Push LLM and tool-call traces to Langfuse, Jaeger, or Tempo.

Manage Builder Portal Access

Control what developers can see and do in their own portal.

Configure GitHub Delivery Attribution

Connect GitHub so AIControls can ingest pull requests for the Outcomes dashboard.

Explore Engineering Outcomes

Compare activity, delivery, and supporting evidence across your workspace.

Manage Productivity Repositories

Discover repositories, automate onboarding, and manage collection scope and skips.

Use the Effectiveness Leaderboard

Enable, read, and tune the developer AI effectiveness leaderboard.

Review PR Contributions

Inspect patches, review optional AI proposals, and recognize related work.