Audit shadow AI inventory integrity

Reconcile the approved AI-service registry against gateway, DNS/CASB, SSO, expense and provider evidence by deduplicating canonical aggregate usage events, then audit registration, status, domain/data-class policy, broker routing, contracts, security/privacy review, telemetry completeness and reported usage/spend.

Constrained optimization Audit CTOs Tech CEOs IT managers Team leads Investors

What it's for

Gives IT leaders one defensible AI inventory across network, identity, expense and provider evidence—without double-counting detections or turning service governance into employee surveillance.

What you give it

Inputs split into evidence read from your connected systems, calibration your team owns, and numerical controls that affect precision but never the result's meaning.

Field	Type	Role	Required
detection_observations	array of objects (12 fields)	Evidence	Yes
detection_sources	array of objects (5 fields)	Evidence	Yes
max_detail_rows	integer ≥ 1, ≤ 500	Numerical control	Optional
minimum_evidence_coverage	number ≥ 0, ≤ 1	Your calibration	Optional
reconciliation_tolerance_fraction	number ≥ 0, ≤ 1	Your calibration	Optional
registered_services	array of objects (11 fields)	Evidence	Yes
usage_statements	array of objects (6 fields)	Evidence	Yes

Each `detection_observations` record

Field	Type	Required
approved_broker_used	boolean	Yes
bytes_sent	number (≥ 0)	Yes
data_class_id	string (non-empty)	Yes
detection_source_id	string (non-empty)	Yes
domain_id	string (non-empty)	Yes
evidence_verified	boolean	Yes
id	string (non-empty)	Yes
observed_at_ms	number (≥ 0)	Yes
observed_cost	number (≥ 0)	Yes
request_count	integer (≥ 0)	Yes
service_fingerprint	string (non-empty)	Yes
usage_event_id	string (non-empty)	Yes

Example input

{
  "detection_observations": [
    {
      "approved_broker_used": true,
      "bytes_sent": 10000,
      "data_class_id": "internal",
      "detection_source_id": "ai-gateway",
      "domain_id": "engineering",
      "evidence_verified": true,
      "id": "gateway-observation-1",
      "observed_at_ms": 1000,
      "observed_cost": 25,
      "request_count": 100,
      "service_fingerprint": "assistant.example",
      "usage_event_id": "aggregate-usage-event-1"
    }
  ],
  "detection_sources": [
    {
      "active_from_ms": 0,
      "active_until_ms": 10000,
      "evidence_verified": true,
      "id": "ai-gateway",
      "telemetry_complete": true
    }
  ],
  "registered_services": [
    {
      "approval_status": "approved",
      "approved_broker_required": true,
      "contract_active": true,
      "evidence_verified": true,
      "id": "approved-assistant",
      "permitted_data_class_ids": [
        "internal"
      ],
      "permitted_domain_ids": [
        "engineering"
      ],
      "privacy_terms_verified": true,
      "provider_id": "provider-1",
      "security_review_current": true,
      "service_fingerprint": "assistant.example"
    }

Truncated for display — the full payload is 56 lines.

What you get back

This is the actual output of running the example above — computed by the same function the platform calls, not an illustration.

Example output

{
  "assumptions": [
    "Gateway, DNS/CASB, SSO, expense and provider evidence is normalized to stable service fingerprints and canonical aggregate usage-event IDs without person-level monitoring.",
    "Repeated source observations of one event carry identical payloads and are deduplicated before statement reconciliation; telemetry completeness is source-owner attested.",
    "Registry status, permitted domains/data classes, broker policy, contracts, security review and privacy terms are point-in-time authoritative for the observation window."
  ],
  "counts": {
    "canonical_usage_events": 1,
    "detection_observations": 1,
    "detection_sources": 1,
    "observed_service_fingerprints": 1,
    "reconciled_services": 1,
    "registered_services": 1,
    "unregistered_service_fingerprints": 0
  },
  "decision": "ai_service_inventory_verified",
  "evidence": {
    "gate_pass": true,
    "minimum_required_fraction": 0.95,
    "verified_fraction": 1
  },
  "integrity_pass": true,
  "limitations": [
    "Passing cannot prove inventory completeness outside represented detectors; encrypted, offline, personal-device, cash-paid or deliberately obfuscated services can remain unseen.",
    "Diagnostics concern aggregate services and governed domains, never individual intent, loyalty, productivity, nationality or employment suitability."
  ],
  "method": "multi_source_canonical_shadow_ai_inventory_reconciliation_v1",
  "observation_diagnostics": [],
  "service_diagnostics": [
    {
      "canonical_usage_events": 1,
      "failed_gates": [],
      "observed_bytes_sent": 10000,
      "observed_cost": 25,
      "observed_request_count": 100,
      "reconciliation_gap_fraction": {
        "bytes": 0,
        "cost": 0,
        "requests": 0
      },
      "registry_service_id": "approved-assistant",
      "service_fingerprint": "assistant.example"
    }
  ],

Truncated for display — the full payload is 46 lines.

How it works

Constrained optimization — Pick the best feasible option under real limits — budget, headcount, dependencies, capacity — rather than ranking a list and hoping it fits.

1 Validate point-in-time registered service fingerprints and complete detector intervals, then normalize observations to canonical aggregate usage-event IDs.
2 Require repeated source observations of one event to agree exactly and deduplicate before computing request, byte and cost totals.
3 Audit unknown/blocked/restricted use, broker bypass, contract/security/privacy evidence and reconcile each observed service to an independent usage statement.

Before you trust it

Every tool in the catalog ships with the conditions under which its answer is meaningful — and the conditions under which it should abstain instead of guessing.

Assumptions & guardrails

Objectives use commensurable locally governed value units, constraints reflect real feasibility, and uncertainty covers plausible adverse inputs.
Fingerprints are stable across detectors, canonical event IDs do not merge different activity, detector completeness is source-attested and registry policy is effective at observation time.
The recommendation is optimal only for its stated objective, feasible set, evidence, and solver guarantee; it is not a universal management optimum.
Passing is bounded to represented detectors and aggregate services; results never establish person-level intent, misconduct, loyalty, nationality or employment suitability.

Minimum evidence

registered_services: required and organization-defined
detection_sources: required and organization-defined
detection_observations: required and organization-defined
usage_statements: required and organization-defined

How to validate it

Backtest the chosen action against simple feasible baselines on held-out scenarios, sweep costs/constraints/risk tolerance, and require constraint feasibility under adverse inputs.

Calibrating it to your org

Same for everyone

The mathematical kernel, validation rules, method version, and JSON output semantics are organization-independent; no tenant-trained coefficients or company benchmark is embedded in the function.

Specific to you

tenant-scoped canonical AI usage ledger normalizing gateway, DNS/CASB, SSO, expense and provider observations to stable service fingerprints and shared aggregate event IDs without person-level surveillance
service fingerprinting, detector/event normalization, source completeness, approved inventory and status, domain/data policy, broker requirement, contract/security/privacy currency, statement perimeter/tolerance, evidence and containment authority

Calibration workflow

1 Define the management decision, target outcome, aggregate unit, privacy boundary, cadence, and prediction/intervention horizon for this organization.
2 Build a tenant-scoped historical cohort using only information available before each prediction or decision; preserve zero periods, censoring, assignment probabilities, and unresolved outcomes when the method requires them.
3 Estimate statistical parameters on training history, but obtain costs, utilities, risk tolerance, practical-effect thresholds, capacity, and policy constraints from accountable decision owners.
4 Validate on later time windows or held-out aggregate units at the deployment grain, against a simple baseline and the function-specific validation strategy.
5 Deploy only if the returned decision clears evidence, overlap, calibration, robustness, and guardrail checks; warning, unsupported, schema-gap, and fallback decisions are abstentions.
6 Monitor realized outcomes, data drift, coverage, and decision regret; recalibrate at a governed cadence or after a detected regime/definition change, never merely because a stakeholder dislikes the result.

Call it from your AI

You don't wire up 388 tools in your MCP client. The GitRevio MCP server exposes 18 tools, three of which let an agent search the catalog, read a tool's schema, and run it — so the assistant finds this one on its own.

gitrevio_capabilities_search
  { "q": "reconcile the approved aiservice registry against" }
  → finds "audit_shadow_ai_inventory_integrity"

gitrevio_capability_describe
  { "capability_id": "audit_shadow_ai_inventory_integrity" }
  → returns the input schema and agent guidance shown on this page

gitrevio_capability_run
  { "capability_id": "audit_shadow_ai_inventory_integrity", "arguments": { ... } }
  → returns the result shown above

Works in Claude Desktop, Claude Code, Cursor, Cline, Continue.dev, Goose and Aider. See the MCP server.

Related tools

Forecast shadow AI unseen exposure loss

Estimate AI services missed by every detector with a Bayesian zero-truncated binomial capture–recapture model, then simulate scenario-dependent visibility, incidents, common provider exposure, usage, value disruption and lognormal loss to produce unseen-inventory and economic VaR/CVaR tails.

Sequential Bayesian & bandits

Optimize shadow AI governance portfolio

Choose block, broker, migrate, allow-with-controls or monitor policy for each aggregate shadow-AI service class, maximizing expected value minus loss CVaR under residual-exposure, detection, control, dependency, exclusion, budget and resource gates while pricing common provider value at risk once through joint survival.

Forecasting & survival

Audit agentic action control integrity

Audit operational AI-agent actions from bounded least-privilege permission scope through independently tested authorization, approval, sandbox, monitoring, rollback or compensation, and kill-switch controls, counting unique value exposure once.

Statistical audit & measurement

Audit AI configuration release integrity

Audit that the exact immutable AI configuration bundle evaluated and approved is the bundle exposed in every staged rollout, with consecutive parent lineage, complete blast-radius declaration, effective runtime controls, monotone traffic and a tested prior-version rollback path.

Causal inference & experiment design

Audit AI data rights provenance integrity

Audit every AI training, fine-tuning, retrieval, evaluation, logging and persisted-output use against an immutable rights grant and the complete derivative lineage, including time, revocation, deletion, purpose, jurisdiction, consent, derivative and evidence gates.