Skip to main content

Coverage

Supported modes: Hosted Available in: Teams -- View pricing

Two precise views of coverage

This page tracks user coverage: which people in your organization have a governed AI surface reporting for them. The Enforcement Coverage by Tool matrix tracks enforcement per event, so a protected host never implies protection for an event path the host does not expose.

The capability matrix is generated directly from the implementation, and CI fails if the documented matrix and implementation disagree. Claude Code, Gemini CLI, Cursor IDE, and direct Kiro CLI tool calls have deterministic deny enforcement on their covered events. Kiro IDE does not enforce.

The /governance/coverage page lists users in your organization who do not currently have any governed AI surface reporting for them. Each entry is a coverage gap, and each gap comes with three admin actions.

What a coverage gap is​

A user counts as covered when at least one of the following is true within the last 7 days:

  • An SDK or gateway session reports traffic keyed to the user's identity (email, identity-provider subject, or SSO subject).
  • The browser extension reports a keep-alive ping from the user.
  • A Scout agent attributes discovered AI traffic back to the user.

Anyone in the org directory who does not match any of these is a gap.

What the page shows​

Columns:

  • User — email and display name, pulled from SSO / directory.
  • Last seen — last governed activity, or never.
  • Source — which surface most recently covered them, or none.
  • Gap age — days since the last coverage signal.
  • Status — open, exempted, escalated, or notified.

Filter by status in the top bar. Sort by gap age to prioritize.

Admin actions​

Each row exposes three buttons. All three are admin+ only; analysts see the list but not the buttons.

Notify​

Sends a templated email to the user asking them to install the SDK / extension / integration appropriate for their role. The email is logged in the notifications log and the user's row flips to notified. If they start reporting within seven days, the row disappears.

Exempt​

Marks the user as intentionally uncovered. Use this for service accounts, executive assistants who do not personally use AI, or contractors with out-of-band tooling. Exempted users are excluded from the coverage percentage on Governance Home and do not show up in the default list. Set an optional reason when you exempt so the next admin understands the choice.

Escalate​

Escalates the gap to the org's configured escalation destination (typically Slack or email, set under /settings/notifications). Use this when Notify has not worked and you want a human to follow up outside the dashboard. Escalated rows stay on the list until covered or exempted.

Permissions​

  • Read: analyst+.
  • Notify / Exempt / Escalate: admin+.
  • The owner role can also revoke exemptions and un-escalate.

Backing API​

  • List: GET /api/orgs/{orgID}/coverage.
  • Notify: POST /api/orgs/{orgID}/coverage/users/{userID}/notify.
  • Exempt: POST /api/orgs/{orgID}/coverage/users/{userID}/exempt.
  • Escalate: POST /api/orgs/{orgID}/coverage/users/{userID}/escalate.