Find the AI use happening outside your controls

The first attempt is to ask. A survey goes round, teams list the AI tools they use, and the result is an inventory of the tools people were willing to write down, assembled at one moment, out of date by the end of the quarter. It is not worthless — it is where the vendor bindings and the known integrations come from — but it answers a different question from the one that was asked, because the usage that matters is the usage nobody thought to declare.

The second is the procurement list, which finds the tools somebody paid for through a purchase order and misses every one paid for on a personal card, every free tier, and every service-account key minted by an engineer during an outage two years ago and never revoked. It is also silent about the commonest bypass there is, which is not a tool at all: a coding assistant whose base URL was never set, falling back to the vendor’s own endpoint, on a machine where nothing looks misconfigured.

The third is a discovery tool with a findings page, and this is where the reporting-integrity problem starts. Any tool can produce a list of findings; the hard part is the sentence underneath the list when it is empty. A console that renders no findings as a green banner has made a claim about your estate, and on most days it has no idea whether it is entitled to. The export could have stopped three weeks ago, the credential it arrives on could have been revoked this morning, or the exporter could be posting on schedule into a mapping that reads none of it. All of those emit exactly the same bytes as a clean estate.

That failure is not hypothetical and Token Observe records the version of it that it shipped. Arrival used to be recorded as a batch arriving, which meant an exporter delivering an empty page every hour held its source at fresh indefinitely — with a row count of zero stored beside the claim, where no state machine read it. A wrong window, a page that came back empty, a permission quietly downgraded to one that returns nothing: those are the commonest ways a real exporter fails, and each is worse than having no feed at all, because coverage was affirmatively asserting freshness over the top.

Coverage records two facts per source and computes one of five states from them. A delivery proves the connector is alive. A delivery carrying at least one row proves the estate was observed. Those are different facts about the world and they are kept in different columns, because they were once the same column and the consequence was a source held at fresh indefinitely by an exporter delivering nothing.

An empty delivery is not meaningless either. A genuinely quiet hour on an egress feed is a real answer, and calling a working exporter silent is how a status surface gets muted, after which it reports nothing at all. So an empty hour keeps the connector alive and moves no observation clock, and connected_empty exists as its own state rather than being folded into a neighbour — fresh would be the lie, and stale would send somebody to fix a connector that is running perfectly.

The silence bounds are a product judgement rather than a constant somebody picked, and the rule behind each is roughly two expected cycles rounded up so a jittery scheduler does not flap. A vendor master bill is published once a calendar month, so the natural gap is already about thirty-one days at its widest and forty-five is the smallest gap that unambiguously means somebody stopped exporting. Egress gets six hours rather than twenty-four for one reason: it keeps the detection window inside a working day, and it is the only source that can catch an exfiltration channel while it is still open.

Freshness alone is always late, though, and that is the gap the third input closes. A credential revoked this morning would leave a billing source reading fresh until well into the following month, so pull-connector runs, push-delivery outcomes and the liveness of the ingest credential a stream arrives through are all joined into the coverage report. Where any of them says collection has demonstrably stopped, a fresh or empty source is demoted to feed_failing — reporting the earlier of two true answers rather than the later one. A verdict that is already unreassuring is left as it is, because stale and never-connected are older and larger facts than a connector that broke this morning. Rotating a credential the normal way, minting the new one before revoking the old, is a normal Tuesday and never reads as an outage.

A finding is identified by its source plus a stable dedup key, and that pair names a condition rather than an observation — so re-scanning against a fresh export advances the counters on the finding that already exists and leaves whoever is triaging it alone. Each pass is a set difference against what was true last time, producing the transitions an operator acts on: new, recurring, escalated, de-escalated, regressed and cleared. A condition that had been resolved and has come back reopens its finding, because that is news.

Closing by absence is deliberately the hardest operation in the whole subsystem, because a wrongly resolved finding is worse than a stale one: it is a condition that was true, is still true, and is now filed as handled. Four things have to hold at once. The run for that source reported completed, since a failed or timed-out run produced a partial picture and I did not see it is not it is not there. The source is one where absence is evidence, which is only the source that reads the gateway’s own tables — a scan of an export sees exactly the rows somebody posted, and an export that omits last month’s shadow key has not remediated it. The source actually ran in that pass, so switching a detector off cannot quietly close everything it ever reported. And the detection side saw its whole population, because a condition that fell past a row ceiling is missing from the observed set for exactly the same reason a remediated one is.

Every bound at the receiver refuses whole rather than truncating, for the same reason: a silently shortened batch leaves you believing Token Observe holds evidence it does not hold. Ten thousand records or eight megabytes per delivery, a burst ceiling on delivery rate, and a cap of fifty unconsumed batches per stream — that last one meaning detection has stopped rather than that the exporter is too fast, which is what the message says. The single tolerance that is not all-or-nothing is the mapping ratio, and it is two-sided on purpose: a few junk rows are dropped and counted, never silently, and a delivery past five per cent is refused whole with the ratio named, because half not mapping is what a wrong mapping looks like rather than what a dirty feed looks like.

Unattended scanning is off by default, and when you switch it on the schedule lives in the database rather than in a process timer. The obvious implementation resets its clock on every restart, so a process redeployed every forty minutes with an hourly interval never scans at all and nothing anywhere reports it — the schedule looks enabled, the logs look healthy, and the radar is simply never asked a question. Instead the next due time is a column written when a run finishes, so a restart changes nothing.