Oversight & the Registry

Oversight is the governance surface: Pending (approvals), Risks, Trace, Registry, Usage, and Security. This page covers the surface and the Registry; the other sections have their own pages.

Where it lives — Workspace vs Console#

Operators switch between two modes from the bottom of the sidebar. In Console — the governance shell — each Oversight section is a top-level rail item (Overview, Registry, Trace, Usage, Approvals, Risks, Security), anchored by a command-center Overview. In Workspace — the everyday app — the same surface appears as a single Approvals icon that opens the member view.

Members only have Workspace: their Approvals icon shows their own pending decisions and their own Trace rows. The full CISO surfaces (Registry, Usage, the Security control plane, the Risks scanner) are Console-only.

Note — The boundary is enforced on the server, not by hiding tabs. A member doesn't get an ambient view of the workspace's private activity — oversight of others is via the audit log, by design.

The Registry#

The Registry is the inventory of every AI worker in the workspace. For each one it shows:

• Owner and department — the accountable human.
• Access — its skills, tools, folder mounts, and secrets.
• Trust — its standing delegation grants.
• Recent activity — drawn from the audit log.
• A computed gap list — e.g. no owner, no department, stale (gone quiet), an over-broad rule, a missing secret.

You can export the Registry to CSV or JSON.

Note — The Registry also lists AI workers you run outside damn.dev — see Governing AI you don't run. Those rows are clearly labelled, because damn.dev records what's declared or observed about them, not what it enforces.

Discovered AI tools#

The Registry also surfaces AI tools found on your team's machines by the desktop app — the ones nobody connected. They appear as detected — not observed rows: damn.dev knows the tool exists and is in use, never what it did. A coverage line states plainly what's covered (enrolled machines) and what isn't (unenrolled machines, and browser web apps). You can Claim a detected tool to assign it an owner, or Dismiss a false positive. Full setup: AI-tool discovery.

From a gap to a rule#

Some gaps — like an agent that touched the main branch, or ran network egress — come with a one-click "+ rule" that opens the enforcement editor pre-filled, so spotting a problem and governing it are one motion.

Next#

• Trace — the tamper-evident record behind every "recent activity."
• Policy & enforcement — turning gaps into standing rules.