> ## Documentation Index > Fetch the complete documentation index at: https://docs.coverbase.com/llms.txt > Use this file to discover all available pages before exploring further. # Coverbase AI agent: example walkthroughs > Six end-to-end Coverbase AI agent (Beta) runs, step by step: onboard a vendor, build a control set mapped to your risk domains from an uploaded policy, build a custom dashboard, triage your work queue, update findings in bulk, and review an assessment in the background. For AI agents: a documentation index is available at [https://docs.coverbase.com/llms.txt](https://docs.coverbase.com/llms.txt). This page is also available in markdown by appending .md to the URL. > [!NOTE] > > This page is part of the [User Guides](https://docs.coverbase.com/user-guides/overview.md) collection and the **Coverbase AI agent (Beta)** set. It sits beside [What the agent can do](https://docs.coverbase.com/user-guides/coverbase-ai-agent-capabilities.md) and [Controls, approvals and governance](https://docs.coverbase.com/user-guides/coverbase-ai-agent-controls.md). For the controls on every run, see [Working with Coverbase AI](https://docs.coverbase.com/user-guides/coverbase-ai.md). > [!NOTE] > > Coverbase AI is in Beta. Your Coverbase team turns it on for your organization. Each walkthrough below is one Coverbase AI run from the instruction to the report, with every point where it stops for you. They are good first runs for a pilot, because each touches a different part of the product and each change is easy to check afterwards. The mistake people make most often in a first run is turning on **Don't stop to ask**. Leave it off for your first runs so you see every checkpoint, then decide which changes your team is content to delegate. ## Onboard a vendor through intake Use this to see the whole lifecycle in one run. Choose **Watch it work** so you can follow it through the product. **1. Give the instruction** Type **Onboard Okta for single sign-on** and press **Enter**. The plan appears and the top bar reads **Working…**. **2. Coverbase AI researches and opens the intake** It researches Okta, opens an intake request (the same request your requesters file), and shows the match it found: what the company does, its website and its headquarters, with the use case it picked. It carries on, and you can correct the match at any time by typing under the run. **3. Screening and the questionnaire** It runs screening, then drafts the inherent risk questionnaire. Each answer carries its source. An answer the research cannot support stays blank with one sentence saying what is missing. It asks you at most three questions only your organization can answer, such as what data Okta will hold. **4. Checkpoint: submit the intake** The card asks to submit the request to your reviewers. Click the approve button. This always asks, because a submitted request lands in a reviewer's queue and cannot be unsent. **5. Review the inherent risk** It researches inherent risk (vendor intelligence, a web search for incidents, Radar's alert history for 24 months and a live scan, the security rating, the intake answers) and pauses on the review. Agree or disagree with each domain, move a level and say why, tick the assessments to run, and confirm. Only the levels you confirm are written to Okta. **6. Checkpoint: launch the assessment** It proposes the assessment, such as "2026 Okta initial" against the control sets you ticked. Approve it. The run then waits, and the top bar reads **Waiting on** the assessment. You can close the tab. **7. Findings and monitoring** When the assessment finishes, the run resumes and you are notified. It reads the results, proposes a finding for each flagged control, assigned to you, and creates a Radar detector for Okta, turned off. Turning the detector on is another checkpoint. **8. Read the report** The report lists what it created with links, the findings to review, your risk adjustments beside its proposal, and the to-dos, such as the questionnaire answers it could not support. **What you approved:** the submission, the inherent risk review, the launch, each finding, and turning the detector on. ## Build a control set mapped to your risk domains from a policy Use this to turn a policy or framework document into a control set your assessments can use. **1. Check your risk domains** Type **List our risk domains** and read the answer. This is read only. Note the names you will map to. **2. Attach the document and give the instruction** Click **+**, choose **Upload files** and add the policy. Then type **Build a control set called Vendor AI controls from this policy. Add a risk domain called AI use if we do not have one.** **3. Checkpoint: build the control set** The card names the document and the new set. Approve it. Coverbase AI builds the set as **Controls > New** does: it reads the document in the background, and the set fills in for you to review. **4. Checkpoint: add the risk domain** Coverbase AI checks your risk domains so it never adds one twice, then asks to add **AI use**. Approve it. **5. Map each domain** Once the control set has filled in, type under the run: **Map each domain of Vendor AI controls to the closest of our risk domains, and tell me which you chose.** Each mapping is a checkpoint. On the first one, click **Approve all like this** to approve the rest of the mappings in this run. A risk domain name that is not one of yours is refused with your real names. **6. Adjust controls** Ask for changes in plain words, such as **Make control 2.3 optional and require evidence on 4.1**. Each control change is a checkpoint, and the card says how many assessments in progress use the set. **What you approved:** building the set, the new risk domain, the mappings (once, with **Approve all like this**), and each control change. ## Build a custom dashboard Use this when no dashboard template answers your question. **1. Give the instruction** Type **Build a board dashboard: open findings by severity, assessments completed per month this year, vendors by inherent risk level, and the number of overdue commitments.** **2. Coverbase AI designs the charts** It looks for a template first. When none answers the question, it composes one chart per thing you asked for, at most eight: a headline number for a single count, a bar chart for a breakdown, a stacked chart for a breakdown split two ways, a line chart for a trend over months. It checks and draws each chart before writing anything. **3. Checkpoint: approve the chart list** The card lists every chart. Approve it, or type a change such as **Split the findings chart by vendor tier**, and it changes the charts and asks again. **4. Read the result** It creates the dashboard, reads it back, and says what each chart shows now, flagging any chart with no rows yet. A chart it could not build from the available options is left out and named in the report. **What you approved:** the chart list. To add charts to the dashboard later, type **Add a chart of overdue findings by owner to the board dashboard**. ## Triage your work queue Use this at the start of the day. **1. Read the queue** Type **What is in my work queue? Group it by vendor and say which items are oldest.** This is read only. **2. Act on items** Type **Mark the two Okta items done and hand the Acme review item to Priya.** Coverbase AI marks your own items done and reassigns the item, and Priya gets the assigned notification. These changes run without a checkpoint and are recorded in the Agent Ledger. **3. Work the items that need a record** An item that comes from a record, such as a review, an intake request or a follow-up, resolves only when its record does, so Coverbase AI does not mark it done. It says so and names where the work is. Ask it to do that work, for example **Review the Acme assessment**. **What you approved:** nothing, unless an admin set **Marking a work queue item done** or **Reassigning a work queue item** to **Always asks**. You may move your own items. An admin may move any item. ## Update findings in bulk Use this to bring a set of findings to one severity, owner and due date. **1. Give the instruction** Type **Find every open finding on our Critical vendors that is overdue. Set each to High, assign it to Priya and make it due January 31, 2027. Show me the list before you change anything.** **2. Coverbase AI resolves the set** It reads the findings register with that filter and names the findings it found. **3. Review the changes** Because you asked, Coverbase AI shows the list before it changes anything. When it proposes the changes as one batch, each with its reason, untick any finding to keep as it is, then click **Apply**. A batch holds at most 50 changes, and the rest come in a second batch after you answer. **4. Read the report** The report lists each finding it changed. Each owner gets the same notifications the finding page sends. **What you approved:** the list. Changing a finding's severity, owner or due date has no checkpoint of its own, so without "show me the list before you change anything" the run makes the changes directly. To make every finding change stop for approval, an admin sets **Updating a finding** to **Always asks**. Coverbase AI never closes a finding or accepts its risk. ## Review an assessment in the background Use this to clear a review backlog while you do other work. **1. Give the instruction** Choose **Run in background** and type **Review the 2026 Atlassian initial assessment.** **2. Coverbase AI works through every control** It reads the assessment, takes each control that needs a person (flagged as an issue, low confidence or marked for review), reads its evaluation, the evidence and the vendor's answer, and decides what it would do: keep the issue, clear it as not an issue, mark it mitigated or risk accepted only when the evidence says so, raise a finding, or add an obligation. **3. One pause: the batch** You are notified. The run pauses once on a list titled like **Review of 2026 Atlassian initial: 10 controls that need a review**, each change with its reason. Untick what you disagree with and click **Apply**, or **Keep all as they are**. **4. It applies what you accepted** Each change you accepted is applied without asking again, and the assessment's scores are recomputed. A change you declined is left as it was, and Coverbase AI keeps a preference from it. **5. Read the report** The report lists every control it changed with the old and the new outcome, the findings and obligations it raised, what it left alone and why, and the export to run next. **What you approved:** one batch. Nothing in a review approves the vendor or sends anything to it. ## Troubleshooting | Problem | What to do | | - | - | | The run asked about each control one at a time | It was in **Watch it work**. Switch to **Run in background** on the run page to get one batch. | | The control set had no domains to map yet | It was still being built from the document. Wait for it to fill in, then send the mapping instruction again. | | A dashboard chart is missing | No available chart option could count it. The report names it, and the run gives the numbers from the records instead. | | A work queue item was not marked done | It comes from a record. Do the work on the record. | | A finding change did not ask first | Changing a finding has no checkpoint. Ask for the list first, or have an admin set **Updating a finding** to **Always asks**. | ## Related > [card] [What the agent can do](https://docs.coverbase.com/user-guides/coverbase-ai-agent-capabilities.md) > > More than 150 example instructions by product area. > [card] [Controls, approvals and governance](https://docs.coverbase.com/user-guides/coverbase-ai-agent-controls.md) > > What stops, what always asks, and who decides. > [card] [Working with Coverbase AI](https://docs.coverbase.com/user-guides/coverbase-ai.md) > > Start a run, answer what it asks, steer it and read the report. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.