Tasks
Step-by-step instructions for common jobs. For background on how a feature works before you configure it, see Concepts.
Connecting AI Tools
Connect Claude Code, Claude Desktop, Cursor, OpenAI Codex, or GitHub Copilot through AIControls.
Read more →
Configure an Upstream
Add and route to an LLM provider.
Read more →
Write a Policy
Author a CEL policy that matches tool calls or LLM requests.
Read more →
Install a Policy Pack
Install a curated set of policies for anomaly detection, egress, approvals, content safety, cost, model access, or MCP tool access.
Read more →
Assign Autonomy Tiers
Set an agent's T1–T4 autonomy tier from the UI or the API.
Read more →
Cost Governance
Set a budget and reduce spend with context optimization.
Read more →
Security & Compliance
Tune detection thresholds, set up the Shadow AI browser extension, govern skill risk, and generate a compliance report.
Read more →
Validate LLM Responses
Write a response-phase policy to scan or block outbound LLM and MCP tool text, including streaming replies.
Read more →
Restrict Network Egress
Limit which domains MCP tool traffic may reach, with scoped rules and exceptions.
Read more →
Approve or Deny a Request
Decide on exception, model-access, and budget top-up requests, including multi-approver co-sign, and revoke a grant.
Read more →
Request an Exception Inline
Ask for a time-boxed exception without leaving your AI tool — reply to the denial, use a governance tool, or run /request-exception.
Read more →
Request a Config-Target Exception
Request and approve a time-bounded exception against a budget cap or an egress allowlist.
Read more →
Connect an MCP Server
Register and authenticate an MCP server with AIControls.
Read more →
Enable Network Egress Filtering
Generate a CA, configure the egress proxy, and write your first egress policy.
Read more →
Enable Runtime Guard
Install the Kyverno runtime sensor, turn on kernel-level observation, and verify coverage. Self-hosted Kubernetes only.
Read more →
Admin Console SSO
Turn on admin console sign-in through the same identity provider you already use for the developer portal and AI clients.
Read more →
Link Your Enterprise Identity
Enable Cross-App Access for PAT-authenticated tools like Claude Code.
Read more →
Create a Team Access Binding
Map an IdP team to one or more MCP servers.
Read more →
Control MCP Tool Access
Grant or deny individual tools per team, user, or agent — with conditions and default-deny.
Read more →
Manage Toolsets
Curate reusable tool sets across servers and attach them to bindings.
Read more →
Rate-Limit MCP Tools
Cap tool call rates per user, agent, or team — deny or warn on exceed.
Read more →
Integrations
Configure webhook, Slack, Teams, S3 export, or Okta agent setup.
Read more →
Export Traces
Push LLM and tool-call traces to Langfuse, Jaeger, or Tempo.
Read more →
Manage Builder Portal Access
Control what developers can see and do in their own portal.
Read more →
Configure GitHub Delivery Attribution
Connect GitHub so AIControls can ingest pull requests for the Outcomes dashboard.
Read more →