Concepts

Assets vs. findings

• Assets are what AI is in your code — the AI-BOM (tools, MCP servers, agents, model refs, prompt files, AI services, AI keys, dependencies).
• Findings are risks — a leaked secret, an insecure code pattern, an exposed cloud resource, a hallucinated dependency.

Severity

info < low < medium < high < critical. The CI/PR enforce gate blocks when a finding is at or above your --fail-on threshold.

Finding status

Status	Meaning
open	New or reopened.
triaged	Acknowledged, being worked.
resolved	Auto-closed when a scan no longer sees it.
ignored	Risk accepted by a person, with a reason.

Manual decisions (triaged/ignored) survive re-scans; scan-resolved findings reopen automatically if the issue returns.

Mode — Monitor Mode

• observe (default): report only. CI exits 0; the Gateway forwards calls but records what it would have blocked. Safe to enable everywhere.
• enforce: gate. CI can fail the build; the Gateway blocks. Turn on per repo/server when you trust it.

A safety floor always applies even in observe: secrets/PII are scrubbed from agent responses, and structural protections (unapproved servers, schema violations, tool-definition drift) stay hard.

Reproducible & offline

Detectors are deterministic — the same repo yields the same findings, every run — which is what makes them safe as a CI gate. scan makes no network calls, and your source stays local unless you --upload.

Shadow AI

AI discovered in a repo that isn't centrally governed — an unapproved MCP server, an unowned agent, a provider key no one signed off on. Discovery surfaces it so you can govern it rather than ban experimentation.

Guard vs Govern

• Guard — authoring-time: CLI / IDE / CI / PR catch risk in code and config before ship.
• Govern — runtime: agent identity, scoped credentials, MCP Gateway policy on every tool call.

Same Monitor Mode idea; different control points. See Guard and Govern.

Agent identity

A registered agent has a named owner, an approved tool scope, and (after approval) a scoped credential. Unregistered agents raise findings at scan time and fail closed at the Gateway. Revocation is an instant kill switch.

Evidence chain

A per-tenant, hash-chained log where every event links to the previous one. Changing any event breaks the chain, and verify reports the exact break — so the audit trail is tamper-evident.

Attestation vs evidence coverage

Compliance packs report evidence coverage (automated signals from your data) and attested % (named humans signing off). Unveilr never auto-marks a control satisfied. Stale attestations appear when the underlying evidence hash changes.

Separation of duties (agent gate)

In production, the principal who registers an agent identity cannot approve it (AGENT_GATE_ENFORCE_SOD). A second admin must approve. Labs can disable this only in isolated automated tests.

SIEM / evidence streaming

Governance decisions can be pushed to a SIEM notification channel (live POST) or pulled via GET /v1/evidence/export?since=… (NDJSON). Gateway AWS deployments also emit to Kinesis / EventBridge / Security Lake.

Policy packs

Installable multi-env packs (pack-dev-observe, pack-staging, pack-production) materialize template policies tagged with an environment — promote by installing the next pack.