What Saible discovers when you connect a source
Each read of a source keeps what it found as a proposal. An organisation admin accepts or rejects each one, and nothing found is acted on before that.
| Source | Read | Proposes | Needs |
|---|---|---|---|
| GitHub or GitLab | every repository: manifests, imports, model ids, provider variable names, prompt files, MCP configurations, CODEOWNERS | AI application; team for a system | GitHub App: Metadata and Contents read |
| OpenAI | projects (keys are not linked: no bill line carries the key) | spend link | an OpenAI Admin key |
| Anthropic | workspaces | spend link | an Anthropic Admin key |
| Amazon Bedrock | invocation logging, guardrails, agents, knowledge bases, IAM roles that call models | AI system or setting | bedrock:GetModelInvocationLoggingConfiguration, ListGuardrails, ListAgents, ListKnowledgeBases, plus cloudtrail:LookupEvents |
| Snowflake | TAG_REFERENCES, OBJECT_DEPENDENCIES, ACCESS_HISTORY (table and column) | personal-data tag; lineage edge | SAIBLE_READER with SNOWFLAKE.OBJECT_VIEWER and SNOWFLAKE.GOVERNANCE_VIEWER (access history: Enterprise edition) |
| Databricks | Unity Catalog tags, table lineage | personal-data tag; lineage edge | the connector's token or service principal |
| dbt in git | model and column tags, depends_on | personal-data tag; lineage edge | the git source's Contents read |
Lineage is proposed only where personal data flows: an edge with one end in a table or column that its own tags mark personal. Every other edge is already in the ontology as the source declared or observed it. A spend link is proposed when a project or workspace name matches a registered application by its words, with a score of 0.5 or more and up to three alternatives. Accepting places spend by the OpenAI project id or the Anthropic workspace id.
| Proposal | Accepting |
|---|---|
| AI application | Claimed into the AI catalogue with you as the owner. You type the purpose. |
| Spend link | A spend attribution rule places this spend on the application you choose. |
| Personal-data tag | The tag is confirmed in the ontology. |
| Lineage edge | The edge is confirmed in the ontology. |
| Team for a system | The team is named on the system. |
| Bedrock agent or calling role | Added to the AI catalogue. You type the purpose. |
| Guardrail, knowledge base, logging off | Your confirmation is recorded. Nothing is changed in your AWS account. |
Confidence is a fixed rule, never a model's figure: a declared tag 0.95, a classification 0.9, a declared edge 0.9 and an observed one 0.8, code by the scan's confidence. A newer read that sees something different supersedes the open proposal. A decided one is never reopened. Values that move on every read, such as a head commit or a call count, do not make a new proposal. Confirming several proposals with one MFA step, in the confirmation tray, is coming.
Each read that proposes something new writes one discovery_proposed record with a SHA-256 over what it proposed. Each decision writes discovery_accepted or discovery_rejected, naming what was seen and the action's own record. These are records in the tamper-evident evidence ledger.
A proposal keeps names, ids, paths, line numbers, hashes and counts. It never keeps a column's contents, a prompt's text or a line of code. People are never proposed: CODEOWNERS gives team names only, and an assumed role's session name is cut off.
See your AI catalogue, from what you already run for the code scan and the claim.
- 1Connect a source: a code host under Catalogue → Systems → Discovered from code, an AI platform under Settings → Providers, or a warehouse or dbt project as an ontology source. Each read proposes what it found.
- 2Open Catalogue → Discovered, or the Discovered card on Home. Each proposal shows where it was seen, when, how sure Saible is, and what accepting will do.
- 3As an organisation admin, press Accept, and type the purpose when the proposal adds a system. Or press Reject and give the reason. Both ask for MFA and are recorded in the evidence ledger.
This topic is also documented as Agent Skills that your agents can load: discovered, discovery, catalog, ontology-sources. Request them from Saible.