SaibleDocs
Exposure

What each AI platform lets through

Read only, with the credentials you already gave Saible. Each finding with the script that fixes it.

Readeach platform,read onlySnapshotchained;two show driftFindingswhere it is fixed,the scriptCoveragecalls thatcarry evidenceSeal reportproposed byan org adminReview queuean org adminseals it↺ every night over the last 30 days, or Run now
From each platform's configuration to a sealed report · nothing is changed on any platform
  • OpenAI
    the Admin key: projects, keys, model permissions, retention
  • Anthropic
    the Admin API key: workspaces, members, API keys
  • Azure OpenAI
    the service principal, plus Reader: accounts, deployments
  • Amazon Bedrock
    the connector's role, plus read grants: logging, guardrails, calls
  • Snowflake
    the reader role: Cortex settings, grants, Cortex usage
  • Databricks
    token or service principal: serving endpoints, their usage
What it reads, with the billing feed's credential · none yet run against a live account
  • Fix from herea control on the platform itself; the finding carries the script, and a person runs it
  • Needs the gatewayonly the request path can do it
  • Platform consoleonly the platform's own console, or a commercial act
Where each finding is fixed · the report never writes to a platform
Do it
  1. 1Connect each platform's billing feed on Settings → Providers; where a read needs one more grant, the report names it.
  2. 2On Exposure, an org admin clicks Run now, or waits for the nightly run.
  3. 3Open a finding: the rows it rests on and the script that fixes it. Run the script yourself.
  4. 4An org admin clicks Acknowledge, or Resolve with why.
  5. 5Click Seal report; an org admin approves it in Review queue.
For your agents

This topic is also written as Agent Skills your agents can load: exposure-report. Ask us for them.

Next · Overview · Where things runRegions: what runs where →