For AI agents: a documentation index is available at https://docs.coverbase.com/llms.txt. This page is also available in markdown by appending .md to the URL.
This page is part of the User Guides collection and opens the Coverbase AI agent (Beta) set. It sits beside How the agent differs from earlier AI features, What the agent can do, Controls, approvals and governance, the FAQ for approvers and administrators and Example walkthroughs. For the day-to-day how-to, see Working with Coverbase AI.
Coverbase AI is in Beta. Your Coverbase team turns it on for your organization. Until then it does not appear in the product, and no run can start. This page describes the product as of October 30, 2026.
What Coverbase AI is
Coverbase AI is the place in Coverbase to get something done. The Ask Coverbase AI chat on a vendor, assessment or Radar signal remains the place to ask a question about one record. Coverbase AI answers questions too, but its purpose is to do the work an analyst does by hand:- Onboard a vendor from its name: research, intake, screening, the inherent risk questionnaire, the assessment, findings and monitoring.
- Review an assessment control by control and propose an outcome for each, with the evidence.
- Build control sets, questionnaires, workflows and dashboards to your description.
- Triage the Radar alert queue, open cases and draft findings.
- Change your organization’s configuration, such as an email template or a scale level, as an admin would.
How a run works
A run is one job, from your instruction to its report. It runs on Coverbase’s servers, not in your browser, so closing the tab never stops it.1
You give an instruction
You type the job into the composer, such as “Onboard Figma for design collaboration”. If you start from a record’s page (a vendor, an assessment, a control’s evaluation, a contract, a Radar signal), the run knows that record, so “this” and “it” mean that record. You can attach files (up to 100 a message, 50 MB each) and point at records from the + menu. See Files and records.
2
Coverbase AI makes a plan
Coverbase AI reads the instruction and picks a playbook: a named job with an ordered plan, the tools it may use and the checkpoints it stops at. When no playbook fits, it writes a custom plan. You see the plan before the first step runs, and you can stop the run at any time. The playbooks are listed in What the agent can do.
3
Coverbase AI works through the plan with tools
Each step calls tools. A tool is one product action, such as reading a vendor, opening an intake request, marking a control’s outcome or creating a Radar detector. Each tool acts as you: a tool that needs a permission you do not hold is refused, and the run says so in its report rather than working around it. The run narrates each step as it goes.
4
Coverbase AI stops at checkpoints
Before a change that reaches another person, costs time or money, or is hard to undo, the run stops and asks. You approve, decline, or type what to do instead. When it needs a decision only you can make, it asks a question with a short menu of options and marks the one it recommends. Archives and anything that cannot be undone stop under every setting. See Controls, approvals and governance.
5
You watch it work, or send it to the background
In Watch it work, your browser follows the run through the product: it opens the page the run is working on, a cursor moves to each field, and a caption says what it is doing and why. In Run in background, nothing moves on your screen and you are notified when it needs you and when it is done. You can switch a live run between the two at any time. The cursor only shows what the run does on the server. It never submits a form for you.
6
Coverbase AI waits when the work takes time
An assessment takes minutes to days. The run records what it waits on, frees its place on the server, and resumes on its own when the assessment finishes. The top bar shows what it is waiting on.
7
Coverbase AI writes a report
Every run ends in a report: what it did in order with a link to each record, what you need to do with a reason each, what it could not do and why, and What cannot be undone, which lists every action the run took that has no way back. When the run is about one vendor, each to-do also lands in your work queue.
8
The Agent Ledger keeps the record
Each change the run made to a record is a row in the Agent Ledger with the record it changed, who asked and who decided. The run’s own log (every step, question, answer and change) stays on the run page, and Export downloads it as a file.
What changes for your program
Today, most programs use Coverbase to orchestrate assessments. A person moves the work from page to page: opens the intake, reviews the match, launches the assessment, reads the results, raises findings, sets up monitoring. AI helps inside each page, for example by evaluating controls or drafting questionnaire answers, and a person takes each next step. With Coverbase AI, one instruction covers the whole sequence. The person’s role moves from doing each step to approving the steps that matter and reading the report.
This is why a move to Coverbase AI needs its own approval. The question is no longer whether an AI output is accurate before a person accepts it. It is which writes a person delegates, and the controls on the Controls, approvals and governance page answer that.
Why it matters
- One instruction replaces a sequence. Onboarding a vendor touches intake, screening, the inherent risk questionnaire, control sets, the assessment, findings and Radar. Coverbase AI runs them in order and stops only where you need to decide.
- Backlogs clear in the background. “Review every assessment assigned to me that is in review” or “Run Zero Touch on every vendor with no assessment” becomes one run with one list of proposed changes to apply.
- Every step is the product’s own step. A record Coverbase AI creates is the same record a person would create on the page, with the same validation, notifications and history.
- Corrections carry forward. When you decline a checkpoint or move a risk level and say why, Coverbase AI keeps it as a preference that later runs read. See Memory.
- The work can be audited. A change to a record is a ledger row naming the run, the record and the decision. The run’s log can be exported for an audit.
Built to stay under your control
These are the properties an approval committee usually asks about first. Each one is detailed on the Controls, approvals and governance page.What Beta means
Coverbase AI is in Beta. Your Coverbase team turns it on for your organization, and it is off until they do. A few modules are not available to Coverbase AI yet: RFPs, Inspect, risk scenarios, sending a contract for signature, and allowlisting a screening match. A run that touches one of them says so in its report and does the rest of the job.Under the hood
For a security or architecture review, these are the facts that usually matter. The FAQ answers more.Troubleshooting
Related
Agent vs earlier AI features
How Coverbase AI differs from the chat, the AI in assessments and the Intake Agent.
What the agent can do
Example instructions for every product area, and what you approve.
Controls, approvals and governance
Permissions, checkpoints, policies, the ledger and data handling.