For AI agents: a documentation index is available at https://docs.coverbase.com/llms.txt. This page is also available in markdown by appending .md to the URL.
This page is part of the User Guides collection and the Coverbase AI agent (Beta) set. It sits beside What the agent can do and Controls, approvals and governance. For the controls on every run, see Working with Coverbase AI.
Coverbase AI is in Beta. Your Coverbase team turns it on for your organization.
Onboard a vendor through intake
Use this to see the whole lifecycle in one run. Choose Watch it work so you can follow it through the product.1
Give the instruction
Type Onboard Okta for single sign-on and press Enter. The plan appears and the top bar reads Working….
2
Coverbase AI researches and opens the intake
It researches Okta, opens an intake request (the same request your requesters file), and shows the match it found: what the company does, its website and its headquarters, with the use case it picked. It carries on, and you can correct the match at any time by typing under the run.
3
Screening and the questionnaire
It runs screening, then drafts the inherent risk questionnaire. Each answer carries its source. An answer the research cannot support stays blank with one sentence saying what is missing. It asks you at most three questions only your organization can answer, such as what data Okta will hold.
4
Checkpoint: submit the intake
The card asks to submit the request to your reviewers. Click the approve button. This always asks, because a submitted request lands in a reviewer’s queue and cannot be unsent.
5
Review the inherent risk
It researches inherent risk (vendor intelligence, a web search for incidents, Radar’s alert history for 24 months and a live scan, the security rating, the intake answers) and pauses on the review. Agree or disagree with each domain, move a level and say why, tick the assessments to run, and confirm. Only the levels you confirm are written to Okta.
6
Checkpoint: launch the assessment
It proposes the assessment, such as “2026 Okta initial” against the control sets you ticked. Approve it. The run then waits, and the top bar reads Waiting on the assessment. You can close the tab.
7
Findings and monitoring
When the assessment finishes, the run resumes and you are notified. It reads the results, proposes a finding for each flagged control, assigned to you, and creates a Radar detector for Okta, turned off. Turning the detector on is another checkpoint.
8
Read the report
The report lists what it created with links, the findings to review, your risk adjustments beside its proposal, and the to-dos, such as the questionnaire answers it could not support.
Build a control set mapped to your risk domains from a policy
Use this to turn a policy or framework document into a control set your assessments can use.1
Check your risk domains
Type List our risk domains and read the answer. This is read only. Note the names you will map to.
2
Attach the document and give the instruction
Click +, choose Upload files and add the policy. Then type Build a control set called Vendor AI controls from this policy. Add a risk domain called AI use if we do not have one.
3
Checkpoint: build the control set
The card names the document and the new set. Approve it. Coverbase AI builds the set as Controls > New does: it reads the document in the background, and the set fills in for you to review.
4
Checkpoint: add the risk domain
Coverbase AI checks your risk domains so it never adds one twice, then asks to add AI use. Approve it.
5
Map each domain
Once the control set has filled in, type under the run: Map each domain of Vendor AI controls to the closest of our risk domains, and tell me which you chose. Each mapping is a checkpoint. On the first one, click Approve all like this to approve the rest of the mappings in this run. A risk domain name that is not one of yours is refused with your real names.
6
Adjust controls
Ask for changes in plain words, such as Make control 2.3 optional and require evidence on 4.1. Each control change is a checkpoint, and the card says how many assessments in progress use the set.
Build a custom dashboard
Use this when no dashboard template answers your question.1
Give the instruction
Type Build a board dashboard: open findings by severity, assessments completed per month this year, vendors by inherent risk level, and the number of overdue commitments.
2
Coverbase AI designs the charts
It looks for a template first. When none answers the question, it composes one chart per thing you asked for, at most eight: a headline number for a single count, a bar chart for a breakdown, a stacked chart for a breakdown split two ways, a line chart for a trend over months. It checks and draws each chart before writing anything.
3
Checkpoint: approve the chart list
The card lists every chart. Approve it, or type a change such as Split the findings chart by vendor tier, and it changes the charts and asks again.
4
Read the result
It creates the dashboard, reads it back, and says what each chart shows now, flagging any chart with no rows yet. A chart it could not build from the available options is left out and named in the report.
Triage your work queue
Use this at the start of the day.1
Read the queue
Type What is in my work queue? Group it by vendor and say which items are oldest. This is read only.
2
Act on items
Type Mark the two Okta items done and hand the Acme review item to Priya. Coverbase AI marks your own items done and reassigns the item, and Priya gets the assigned notification. These changes run without a checkpoint and are recorded in the Agent Ledger.
3
Work the items that need a record
An item that comes from a record, such as a review, an intake request or a follow-up, resolves only when its record does, so Coverbase AI does not mark it done. It says so and names where the work is. Ask it to do that work, for example Review the Acme assessment.
Update findings in bulk
Use this to bring a set of findings to one severity, owner and due date.1
Give the instruction
Type Find every open finding on our Critical vendors that is overdue. Set each to High, assign it to Priya and make it due January 31, 2027. Show me the list before you change anything.
2
Coverbase AI resolves the set
It reads the findings register with that filter and names the findings it found.
3
Review the changes
Because you asked, Coverbase AI shows the list before it changes anything. When it proposes the changes as one batch, each with its reason, untick any finding to keep as it is, then click Apply. A batch holds at most 50 changes, and the rest come in a second batch after you answer.
4
Read the report
The report lists each finding it changed. Each owner gets the same notifications the finding page sends.
Review an assessment in the background
Use this to clear a review backlog while you do other work.1
Give the instruction
Choose Run in background and type Review the 2026 Atlassian initial assessment.
2
Coverbase AI works through every control
It reads the assessment, takes each control that needs a person (flagged as an issue, low confidence or marked for review), reads its evaluation, the evidence and the vendor’s answer, and decides what it would do: keep the issue, clear it as not an issue, mark it mitigated or risk accepted only when the evidence says so, raise a finding, or add an obligation.
3
One pause: the batch
You are notified. The run pauses once on a list titled like Review of 2026 Atlassian initial: 10 controls that need a review, each change with its reason. Untick what you disagree with and click Apply, or Keep all as they are.
4
It applies what you accepted
Each change you accepted is applied without asking again, and the assessment’s scores are recomputed. A change you declined is left as it was, and Coverbase AI keeps a preference from it.
5
Read the report
The report lists every control it changed with the old and the new outcome, the findings and obligations it raised, what it left alone and why, and the export to run next.
Troubleshooting
Related
What the agent can do
More than 150 example instructions by product area.
Controls, approvals and governance
What stops, what always asks, and who decides.
Working with Coverbase AI
Start a run, answer what it asks, steer it and read the report.