Cartographer
Maps which AI services your organisation already uses, and by whom.
What changes for the organisation
You find out which AI services your organisation is already using, by department, before someone else does.
How it works
It ingests your existing egress proxy and DNS logs alongside the M0 event store, resolves destinations against the signed catalog, and maintains a heuristic suspected-AI bucket for services the catalog does not yet know.
What it watches
- The M0 event store — everything the enforced surface already sees
- Your existing egress proxy and DNS logs, via ingestion connectors
- Destination catalog resolution: sanctioned, unsanctioned, internal, or suspected-AI
How it actually works
The mechanism, not the marketing. If a step below would not survive an engineer's scrutiny, it should not be on this page.
1
Two feeds, and no new sensor
M0 events cover the enforced surface. Your existing egress-proxy and DNS logs cover everything else, through ingestion connectors. Connectors checkpoint with replay semantics, so an outage backfills the window rather than silently losing it.
2
Destinations resolve against signed content
Hostnames and endpoints are matched against the versioned catalog and classed sanctioned, unsanctioned or internal. Adding a newly launched AI service is a content update, not a software release.
3
What the catalog does not know becomes “suspected”
Traffic with the shape of generic LLM API usage — endpoint pattern, request cadence, payload size distribution, streaming response behaviour — that matches no catalog entry is bucketed as suspected AI. Never as identified. The catalog is updated monthly by offline bundle, and this is what covers the gap between bundles.
4
Attribution is quality-scored, not asserted
Proxy records carry a source IP and often a username; resolution to an AD identity is scored, and anything with no resolvable interactive user is flagged unattributed rather than guessed at.
5
The privacy floor applies before rendering
Low-count suppression runs before any departmental figure displays, so a team of three never resolves into three people. Per-user drilldown is a separate authorised action, and it is logged.
6
Every figure carries its own provenance
Cutoff, watermark, connector health, filter scope and projection version render with the number. A degraded connector shows as degraded — it does not quietly show as a smaller number.
Operating path
From signal to auditable evidence
01Observed inputs
- The M0 event store — everything the enforced surface already sees
- Your existing egress proxy and DNS logs, via ingestion connectors
- Destination catalog resolution: sanctioned, unsanctioned, internal, or suspected-AI
02Deterministic workflow
- 1 Two feeds, and no new sensor M0 events cover the enforced surface. Your existing egress-proxy and DNS logs cover everything else, through ingestion connectors. Connectors checkpoint with replay semantics, so an outage backfills the window rather than silently losing it.
- 2 Destinations resolve against signed content Hostnames and endpoints are matched against the versioned catalog and classed sanctioned, unsanctioned or internal. Adding a newly launched AI service is a content update, not a software release.
- 3 What the catalog does not know becomes “suspected” Traffic with the shape of generic LLM API usage — endpoint pattern, request cadence, payload size distribution, streaming response behaviour — that matches no catalog entry is bucketed as suspected AI. Never as identified. The catalog is updated monthly by offline bundle, and this is what covers the gap between bundles.
- 4 Attribution is quality-scored, not asserted Proxy records carry a source IP and often a username; resolution to an AD identity is scored, and anything with no resolvable interactive user is flagged unattributed rather than guessed at.
- 5 The privacy floor applies before rendering Low-count suppression runs before any departmental figure displays, so a team of three never resolves into three people. Per-user drilldown is a separate authorised action, and it is logged.
- 6 Every figure carries its own provenance Cutoff, watermark, connector health, filter scope and projection version render with the number. A degraded connector shows as degraded — it does not quietly show as a smaller number.
03Evidence outputs
- Shadow-AI inventory by destination, AD group and OU, trended over time
- Override rates, block rates, dispute rates, rollout-stage progress and top triggered categories
- The analytical feed that populates per-regulator report packs
A case
“Why did AI usage jump 40% last week?”
The question that decides whether an observability tool is an instrument or a decoration.
Monday
The projection shows unsanctioned AI destinations up 40% week on week. The figure renders with its watermark and projection version attached.
Drilldown
By OU, the increase concentrates almost entirely in one department. Low-count suppression holds; no individual resolves.
The catalog gap
Three of the top five destinations sit in the suspected-AI bucket — real traffic, LLM-shaped, matching no catalog entry. The dashboard says suspected, on the tile, not in a footnote.
Investigation
One is a translation service with an LLM backend, adopted by the team without review. The other two are regional services not yet in the catalog.
The honest correction
The watermark had moved: a proxy connector that had been degraded for nine days recovered and backfilled. Roughly 28 points of the “increase” was newly-visible existing usage. Only 12 was growth.
Action
The catalog is extended locally, policy scoped to the department, and that department moves from observe to warn.
What it came to
The interesting answer was that the number was partly an artefact — and the product said so itself. An inventory that cannot distinguish new usage from newly-visible usage will mislead you at exactly the moment you brief an executive.
How a decision gets made
The authority ladder. Green rungs are authoritative — a rule, a scanner, a sandbox, or a person. Blue is where the model contributes. Amber is where a human decides.
03
Heuristic bucket
Generic LLM-API traffic signatures surface unknown services between catalog updates, explicitly labelled as suspected rather than identified.
04
Privacy floor
Low-count suppression applies before any departmental view renders. Per-user drilldown is a separate, authorised, logged action.
What the model adds
Pattern description over the inventory — which departments are converging on which services, and how that is trending.
What it cannot claim
It cannot see what proxy and DNS cannot see. Local and on-device models of the Ollama class are invisible to this telemetry; that gap is recorded, not papered over.
What it will never do
- Never deploys a network sensor of ours. It consumes logs you already produce.
- Never attributes below the low-count suppression threshold, so a department of three does not become a list of three names.
- Never presents an inventory figure without its cutoff, watermark, connector health, filter scope and projection version. Provisional and degraded states are shown, not hidden.
- Never claims completeness it cannot have — catalog staleness between monthly bundles is stated, which is exactly why the suspected-AI bucket exists.
What evidence it leaves
- Shadow-AI inventory by destination, AD group and OU, trended over time
- Override rates, block rates, dispute rates, rollout-stage progress and top triggered categories
- The analytical feed that populates per-regulator report packs
See it work
In the operator console
These surfaces are designed and reviewable in the console reference.
Status and what promotion requires
Phase 1.5. Freeze requires the first named proxy and DNS product/version targets, numeric capacity and projection-refresh SLOs, approved workforce-privacy defaults, and agreed metric definitions.
Roles that touch it
Policy AdminSOC AnalystAuditor / ComplianceExecutive Sponsor / CISO