ClovieKnow every agent you run, not just the ones you registered.
Connectors read your clouds, Kubernetes clusters, model provider organizations and SaaS agent platforms. The gateway reports every key it rejects. Together they build an inventory nobody has to maintain by hand.
Agents
| Identity | Owner | Provider | Trust | Confidence |
|---|---|---|---|---|
| kyc-docreview@westmarch-aiService account · Vertex AI | KYC OperationsConfirmed | Google Cloud | Approved | High · 96% |
| role/claims-intake-bedrockIAM role · Bedrock | ClaimsSuggested | AWS | Provisional | Medium · 71% |
| HR Benefits HelperCopilot Studio agent · bypassing gateway | UnownedNo rule matched | Microsoft 365 | Discovered | Low · 38% |
| proj_wm-advisor-copilotOpenAI project · 4 keys | Advisory ServicesConfirmed | OpenAI | Approved | High · 92% |
| risk-models/llm-batchKubernetes service account | Ambiguous2 teams match | Kubernetes | Quarantined | Medium · 64% |
| Branch ConciergeAgentforce agent | Branch OperationsConfirmed | Salesforce | Retired | High · 90% |
A spreadsheet inventory is out of date the day it’s finished.
Agents are everywhere
Bedrock, Foundry, Vertex AI, Copilot Studio, Agentforce, Now Assist, Kubernetes and laptops, each with its own console.
Ownership is a guess
Service accounts and API keys rarely say which team, product or person they belong to.
Shadow usage is invisible
AI calls that bypass the gateway never show up in any governance report.
Clovie treats discovery as the start of governance, not a report. Everything it finds gets a trust state and an owner, and one click puts it under the gateway.
Discovery fills the registry; nothing is governed until someone decides.
See it at work
Register agent
- Name
- Card Dispute Triage
- Owner team
- Cards & Payments
- Project
- Customer Channels
- Environment
- Development
- Monthly budget
- $2,000
Audit log
| Time | Agent | Model | Decision |
|---|---|---|---|
| 14:02:11 | Card Dispute Triage | gpt-4o | Deny |
| 14:01:58 | Fraud Alert Triage | claude-sonnet-4.5 | Allow |
- Policy
- Card numbers stay out of prompts
- Mode
- Enforcing
- Reason
- Card number found in the prompt
- Provider call
- Not made
What you get
Nine discovery connectors
AWS, Google Cloud, Azure, Kubernetes, OpenAI, Anthropic, Salesforce Agentforce, ServiceNow and Microsoft 365 Copilot, each with read access only.
Microsoft Agent 365
Import the Agent 365 registry and Entra Agent ID identities, register governed agents in Agent 365 and keep the registration up to date.
Trust states
Every identity is Discovered, Provisional, Approved, Quarantined or Retired, and each state change is recorded.
Ownership
Rules and tags suggest an owner team; a person confirms it. Unowned and ambiguous identities stand out.
Bypassing the gateway
See which identities made AI calls that didn’t go through Clovie, from cloud audit logs and provider records.
Shadow agents
Keys tried against the gateway that aren’t registered, revoked or invented, with source, model and attempts. The key itself is never stored.
Also in this layer
| Capability | What it does |
|---|---|
| Govern in one step | Create a registered agent with owner, environment and risk category, and get what you need to route it through the gateway. |
| Posture at source | Check agents on Bedrock, Foundry, Vertex AI, Agentforce, Now Assist and Microsoft 365 Copilot for missing guardrails or logging, with four-eyes approval for remote changes. |
| Agent map | See how agents, models and tools connect across the estate. |
Controls mapped to the frameworks you answer to
- SOC 2: SOC 2 Type II trust services criteria
- NIST AI RMF: NIST AI Risk Management Framework
- EU AI Act: EU Artificial Intelligence Act
- ISO/IEC 42001: ISO/IEC 42001 AI management system
- OSFI E-23: OSFI Guideline E-23, model risk management (Canada)
Runs wherever Clovie runs
- SaaS
- Customer VPC
- On-premises
- Air-gapped
Connectors run in every deployment mode. In air-gapped installs, your clouds must be able to reach the install’s identity issuer, or an admin can allow stored keys.
Questions
Does discovery change anything in my cloud?
No. Connectors read. Changes to vendor platforms, such as registering in Agent 365 or remote posture fixes, need a separate write permission and an explicit setting, with four-eyes approval on by default.
Do you read secrets from Kubernetes?
No. The Kubernetes connector reads service accounts and pods; secrets are never read.
What happens to a quarantined identity?
Its AI traffic through the gateway is blocked until someone approves it. Org admins, admins and policy admins can quarantine.
How do I bring a discovered agent under governance?
Choose Govern. Clovie creates a registered agent with the owner, environment and risk you set, and shows how to route it through the gateway.
Start with an honest inventory.
See discovery and inventory on your own agents, in the deployment you need.