Skip to main content
Discover finds AI that is in use but not registered. It looks at traffic through the AI Gateway on keys that belong to no AI system, and lets you bring each one under governance in a few clicks. Nothing is installed anywhere: Discover reads the AI Gateway’s own request log. Owners, admins and Governance Leads can open Discover when your organization has the AI Gateway. Owners and admins act on what it finds.

​
Coverage

Four figures at the top show how much of your traffic is governed, for the range you pick (this month by default, up to 92 days):
  • Registered: the share of requests that came from an AI system’s keys.
  • Guarded: the share of requests a guardrail checked.
  • Unguarded keys: active keys no guardrail checks.
  • Unregistered spend: what traffic outside any AI system cost.

​
What it finds

Each row is one key, busiest first:
  • Organization keys that belong to no AI system;
  • People using AI directly, on their own personal keys.
A row shows which clients the key was used through (Claude Code, Cursor, an SDK), its requests and spend, the models it asked for, the MCP tools it called, and when it was last seen. View requests opens those requests in the request log. Discover lists the 200 busiest keys. Above the rows, Assets not reviewed lists the MCP servers and models in use that nobody has approved or blocked yet. Review opens each one.

​
Register traffic as an AI system

On an organization key, choose Register as AI system. This is the usual registration, with the details filled in from the traffic and one extra step that picks the keys to attach. The key you started from is ticked, and so is every other key used through the same client. Choose Register and attach.
Attaching a key to an AI system is final. The key cannot move to another AI system or be detached, and its requests count as the AI system’s from then on.A new AI system starts in Draft, and the AI Gateway refuses the keys of an AI system that is not Live. Once you choose Register and attach, those keys stop working until the AI system is approved and goes live. To keep the traffic flowing, register the AI system on its own first, take it through approval, and attach the keys once it is live.
If a key cannot be attached, the AI system is still registered and the other keys are still attached. Altrum names the key so you can try again. Personal keys cannot be attached. They always belong to their person.

​
Attach to an existing AI system

When a key’s traffic belongs to an AI system you already registered, choose Attach to an AI system and pick it. If that AI system is not live, the dialog warns you: its requests are refused from the next one until it goes live.

​
Dismiss what needs no AI system

Some traffic is known and fine: a developer trying a model, a load test. Choose Dismiss and say why. The key moves to Dismissed, with your reason, and stops raising alerts. A dismissed key comes back on its own once it has sent five times as many requests as when you dismissed it. Restore brings it back sooner.

​
Alerts

The Unregistered AI alert tells you when a key with no AI system sends more than 50 requests in a day. You can change the number. It never fires for a dismissed key. If your organization has the AI Gateway but not governance, Discover still shows coverage and traffic, without registering or attaching. Dismissing and restoring are recorded in the audit trail.