Skip to content
Brutor AI Docs

AI Asset Registry

The AI Asset Registry (Governance → AI Asset Registry) is the tenant’s single inventory of AI assets: every LLM model, provider, routing group, MCP server, skill, agent card, agent identity and AI System gets exactly one row, whether it entered the platform by being configured, imported from vendor telemetry, or spotted by out-of-band discovery.

AI Asset Registry — inventory with coverage scorecard

The coverage scorecard splits assets across three planes:

Plane Meaning
Governed Configured in the gateway and enforced inline
Observed Imported from vendor traffic (Traffic Data Import) for cost/usage visibility — not enforced; enable the asset to govern it inline
Ungoverned “Shadow AI” — seen by the discovery plane but not configured in the gateway

Asset kinds

Section titled “Asset kinds”

asset_kind is one of: llm_model, llm_provider, routing_group, mcp_server, skill, agent_card, ai_system, agent_identity.

Two kinds deserve a note:

  • ai_system — sourced from resource groups with group_type: "ai_system". This is the auditor-legible inventory unit: risk tier is seeded from the group’s EU AI Act tier.
  • agent_identity — sourced from agent identities; owner is seeded from the identity’s owner label.

The governance overlay

Section titled “The governance overlay”

Each row carries operator-owned governance fields that discovery never overwrites:

Field Values Purpose
owner free text Accountable person/team
lifecycle_stage proposed · approved · active · deprecated · retired Where the asset is in its life
risk_tier minimal · limited · high · unacceptable EU AI Act-aligned classification
intended_use free text What this asset is for
enforcement_mode off · warn · enforce Declared enforcement intent
status ok · review_due · flagged Review state
tags JSON Anything else

Sync

Section titled “Sync”

Sync now in the UI (or POST /v1/admin/assets/sync) rescans the config tables and reconciles the registry:

  • Newly seen assets are created; changed ones updated. Sync only refreshes presentation fields (display_name, icon_url, source_enabled, observed) — the governance overlay is untouched.
  • Rows whose backing configuration has disappeared are flagged status: "flagged" (orphaned) — never deleted, so the audit trail survives the asset.
  • Manually registered assets are left alone.
Terminal window
curl -s -X POST http://localhost:5050/v1/admin/assets/sync \
  -H "Authorization: Bearer $ADMIN_JWT"
{ "created": 3, "updated": 34, "orphaned": 1, "total": 38 }

API

Section titled “API”

Base: /v1/admin/assets on the Control Plane (:5050). Tenant admins are pinned to their tenant; system admins must pass ?tenant_id=.

Method Path Purpose
GET /v1/admin/assets List — filters: asset_kind, lifecycle_stage, risk_tier, status, q, limit (≤500), offset
POST /v1/admin/assets Register a manual asset the scan can’t see
GET /v1/admin/assets/{asset_id} Detail
PATCH /v1/admin/assets/{asset_id} Update governance fields
DELETE /v1/admin/assets/{asset_id} Delete
POST /v1/admin/assets/sync Reconcile against config
GET /v1/admin/registry Coverage counts (governed + discovered — “N seen, M governed”)

Classify an asset:

Terminal window
curl -s -X PATCH http://localhost:5050/v1/admin/assets/aiasset-01K0... \
  -H "Authorization: Bearer $ADMIN_JWT" \
  -H "Content-Type: application/json" \
  -d '{"owner": "RevOps", "risk_tier": "high", "lifecycle_stage": "active",
       "intended_use": "Customer-facing revenue copilot"}'

The response is the updated asset row:

{
  "id": "aiasset-01K0...",
  "asset_kind": "ai_system",
  "ref_id": "group-9695PF5QCEM1QN0ASGS6N",
  "display_name": "ACME Revenue Copilot",
  "owner": "RevOps",
  "lifecycle_stage": "active",
  "risk_tier": "high",
  "enforcement_mode": "off",
  "status": "ok",
  "observed": false,
  "source": "discovered"
}

Fact sheets

Section titled “Fact sheets”

Every asset has a fact sheet — a live dossier assembled from the registry row, the underlying configuration, and runtime evidence from the proxy logs:

Per-asset fact sheet

Section Contents
asset The registry row and its governance overlay
config Per-kind static metadata from the underlying config row
usage Requests, tokens, estimated cost, error rate, latency, first/last seen — plus observed (imported) usage
guardrails Guardrail blocks, PII detections, argument-policy denials involving this asset
compliance Per-framework implicated counts (soc2, eu_ai_act, hipaa, gdpr_art_30, iso_42001)
residency Regions routed to, residency class counts
access Which resource groups can reach the asset

The evidence window defaults to 720 hours (30 days); pass period_hours=0 for all-time.

Terminal window
# Live fact sheet (JSON; ?format=csv for a flat export)
curl -s "http://localhost:5050/v1/admin/assets/aiasset-01K0.../factsheet?period_hours=720" \
  -H "Authorization: Bearer $ADMIN_JWT"


# Capture an immutable snapshot (audit evidence)
curl -s -X POST http://localhost:5050/v1/admin/assets/aiasset-01K0.../factsheet/snapshot \
  -H "Authorization: Bearer $ADMIN_JWT"

Snapshots are append-only and immutable (trigger: manual | scheduled | export), listable via GET .../factsheet/snapshots — the “point-in-time evidence” an auditor asks for. ISO 42001 control coverage cites fact sheets as design-documentation evidence.

Section titled “Related”