AI Automation Feature Guide

Overview

AI Automations help you automatically discover AI assets across supported platforms and add them to your AI Governance inventory, so you can see what models, agents, and related resources are in use without relying on manual tracking. After you connect a supported system, the automation runs a scan, captures key metadata, and makes the results available in your inventory to support governance, risk review, and ongoing monitoring.

AI Automations are deployed using the lightweight worker node, which grants a simplified experience and minimizes the need for specialized personnel. It can retrieve all prerequisites and images from a cloud API, ensuring smooth, firewall-independent deployment. For more information, see Lightweight Worker Node Deployment & Automation Guide and AI Automation Overview.

OneTrust currently supports the following systems for AI automation. The setup in the platform the same for each, resources, prerequisites, and preliminary configurations will be unique to the system.

Amazon Bedrock & AgentCore Automation

Important:

The OneTrust Amazon Bedrock & AgentCore connector supports discovery for both Classic Bedrock Agents and Bedrock AgentCore.

Discoverable Resources

  • Agents

  • Models

Prerequisites

  • Enable Bedrock AgentCore in your AWS account.

  • Make sure the Bedrock models, Bedrock agents, or AgentCore runtimes you want to discover already exist.

  • If you want to collect evaluation data, complete the AWS prerequisites for batch evaluations.

  • If you want to collect observability metrics, enable AgentCore observability in AWS.

  • Create or identify the S3 buckets used for evaluation results and Bedrock invocation logs.

  • Use the below IAM policy to allow OneTrust AI Automations to discover Bedrock AgentCore assets and collect related evaluation and observability data. Replace these placeholders in the IAM policy before you use it:

    Placeholders

    Input

    {{ACCOUNT_ID}}

    AWS account ID

    {{evaluation-results-bucket}}

    S3 bucket that stores evaluation results

    {{bedrock-invocation-logs-bucket}}

    S3 bucket that stores Bedrock invocation logs

    "*"

    All resources

    "service:*"

    All actions in that service
    JSON 
    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "STSIdentity",
            "Effect": "Allow",
            "Action": [
                "sts:GetCallerIdentity"
            ],
            "Resource": "*"
        },
        {
            "Sid": "BedrockListOperations",
            "Effect": "Allow",
            "Action": [
                "bedrock:ListFoundationModels",
                "bedrock:ListCustomModels",
                "bedrock:ListImportedModels",
                "bedrock:ListEvaluationJobs",
                "bedrock:GetModelInvocationLoggingConfiguration",
                "bedrock:ListAgents"
            ],
            "Resource": "*"
        },
        {
            "Sid": "BedrockGetFoundationModel",
            "Effect": "Allow",
            "Action": [
                "bedrock:GetFoundationModel",
                "bedrock:GetFoundationModelAvailability"
            ],
            "Resource": "arn:aws:bedrock:*::foundation-model/*"
        },
        {
            "Sid": "BedrockGetEvaluationJob",
            "Effect": "Allow",
            "Action": [
                "bedrock:GetEvaluationJob"
            ],
            "Resource": "arn:aws:bedrock:*:{{ACCOUNT_ID}}:evaluation-job/*"
        },
        {
            "Sid": "BedrockAgentGetAndList",
            "Effect": "Allow",
            "Action": [
                "bedrock:GetAgent",
                "bedrock:ListAgentAliases"
            ],
            "Resource": "arn:aws:bedrock:*:{{ACCOUNT_ID}}:agent/*"
        },
        {
            "Sid": "BedrockGetAgentAlias",
            "Effect": "Allow",
            "Action": [
                "bedrock:GetAgentAlias"
            ],
            "Resource": "arn:aws:bedrock:*:{{ACCOUNT_ID}}:agent-alias/*/*"
        },
        {
            "Sid": "AgentCoreDataPlane",
            "Effect": "Allow",
            "Action": [
                "bedrock-agentcore:ListBatchEvaluations",
                "bedrock-agentcore:GetBatchEvaluation"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AgentCoreRuntime",
            "Effect": "Allow",
            "Action": [
                "bedrock-agentcore:GetAgentRuntime"
            ],
            "Resource": "arn:aws:bedrock-agentcore:*:{{ACCOUNT_ID}}:runtime/*"
        },
        {
            "Sid": "AgentCoreControlPlane",
            "Effect": "Allow",
            "Action": [
                "bedrock-agentcore:ListAgentRuntimes",
                "bedrock-agentcore:ListAgentRuntimeEndpoints",
                "bedrock-agentcore:ListAgentRuntimeVersions"
            ],
            "Resource": "*"
        },
        {
            "Sid": "CloudWatchMetrics",
            "Effect": "Allow",
            "Action": [
                "cloudwatch:ListMetrics",
                "cloudwatch:GetMetricData"
            ],
            "Resource": "*"
        },
        {
            "Sid": "CloudWatchLogsStartQuery",
            "Effect": "Allow",
            "Action": [
                "logs:StartQuery",
                "logs:GetLogGroupFields",
                "logs:GetQueryResults"
            ],
            "Resource": "*"
        },
        {
            "Sid": "S3ListBuckets",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::{{evaluation-results-bucket}}/*",
                "arn:aws:s3:::{{bedrock-invocation-logs-bucket}}/*"
            ]
        },
        {
            "Sid": "S3GetObjects",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::{{evaluation-results-bucket}}/*",
                "arn:aws:s3:::{{bedrock-invocation-logs-bucket}}/*"
            ]
        }
    ]
}

Automation Setup

  1. On the AI Governance menu, select Setup > AI automations. The AI Automations screen appears.

  2. Click the Set up automation button. The Set up automation modal appears.



  3. Select the Amazon Bedrock & AgentCore tile.



  4. The modal will update with automatically generated details for this new automation. The automation name defaults to "Amazon Bedrock" with a random, system-generated alphanumeric ID. Example: Amazon Bedrock_VL9k3sA

    Note:

    The automation details are set to default, and you can modify them later in the automation page. These can be modified post-setup. The automation will run upon creation.



  5. Select existing credentials from prior automations, which are stored in our Integrations module, or create new credentials.



    Creating new credentials requires that you provide the Access key ID and Secret access key from your targeted Bedrock account.



    Select Use IAM instance profile if your automation runs on an AWS lightweight worker node that is configured with an IAM instance profile. You do not need to provide an Access key ID or Secret access key when you use this option.

    This option is not displayed for automations that run on other worker node types.



  6. When finished, click the Create automation button. The automation will be executed, and you will be navigated back to the Automations list screen.



    Tip:

    If the automation shows an Error status, check and update your credentials.



  7. Your automation is now running and ready to populate your AI Governance inventory. Agents discovered during the scan can be found in the AI agents inventory, while models can be found in the Models inventory. By default, the next sync will occur one month from the creation date. You can customize the sync frequency after setup to daily, weekly, monthly, or yearly as needed.

Amazon SageMaker Automation

Discoverable Resources

  • Models

Required Permissions

  • sagemaker.list_models

Automation Setup

  1. On the AI Governance menu, select Setup > AI automations. The AI Automations screen appears.

  2. Click the Set up automation button. The Set up automation modal appears.



  3. Select the Amazon SageMaker tile.



  4. The modal will update with automatically generated details for this new automation. The automation name defaults to "Amazon SageMaker_" with a random, system-generated alphanumeric ID. Example: Amazon SageMaker_6VOda0S

    Note:

    The automation details are set to default and you can modify them later in the automation page. These can be modified post-setup. The automation will run upon creation.



  5. Select existing credentials from prior automations, which are stored in our Integrations module, or create new credentials.



    Creating new credentials requires that you provide the Access key ID and Secret access key from your targeted SageMaker account.



  6. When finished, click the Create automation button. The automation will be executed and you will be navigated back to the Automations list screen.



    Tip:

    If the automation shows an Error status, check and update your credentials.



  7. Your automation is now running and ready to populate your AI Governance inventory. Models discovered during the scan can be found in the Models inventory. By default, the next sync will occur one month from the creation date. You can customize the sync frequency after setup to daily, weekly, monthly, or yearly as needed.

Azure Foundry Automation

Discoverable Resources

  • Models

  • Agents

Prerequisites

  • Access to an Azure subscription with Azure AI Foundry enabled

  • Registered Azure AD Application (Service Principal)

  • At least one of the following permission levels in order to access Microsoft's List Agents API:

    Note:

    Ensure that the service principal used for authentication has been granted one of the following roles within the Azure AI Foundry workspace.

    Role

    Description

    Foundry User

    Provides full read and interaction access to AI Foundry resources.

    Reader

    Provides read-only access, allowing retrieval of agent details but not modification.

Automation Setup

  1. On the AI Governance menu, select Setup > AI automations. The AI Automations screen appears.

  2. Click the Set up automation button. The Set up automation modal appears.



  3. Select the Azure Foundry tile.



  4. The modal will update with automatically generated details for this new automation. The automation name defaults to "Azure Foundry_" with a random, system-generated alphanumeric ID. Example: Azure Foundry_toZ3chk

    Note:

    The automation details are set to default and you can modify them later in the automation page. These can be modified post-setup. The automation will run upon creation.



  5. Select existing credentials from prior automations, which are stored in our Integrations module, or create new credentials.



    Creating new credentials requires that you provide the Client ID, Client secret, and Tenant ID from your targeted Foundry account.



  6. When finished, click the Create automation button. The automation will be executed and you will be navigated back to the Automations list screen.



    Tip:

    If the automation shows an Error status, check and update your credentials.



  7. Your automation is now running and ready to populate your AI Governance inventory. Agents discovered during the scan can be found in the AI agents inventory, while models can be found in the Models inventory. By default, the next sync will occur one month from the creation date. You can customize the sync frequency after setup to daily, weekly, monthly, or yearly as needed.

Databricks Automation

Discoverable Resources

  • Models

  • Agents

  • Datasets

Automation Setup

  1. On the AI Governance menu, select Setup > AI automations. The AI Automations screen appears.

  2. Click the Set up automation button. The Set up automation modal appears.



  3. Select the Databricks tile.



  4. The modal will update with automatically generated details for this new automation. The automation name defaults to "Databricks" with a random, system-generated alphanumeric ID. Example: Databricks_BWcJ8OC

    Note:

    The automation details are set to default and you can modify them later in the automation page. These can be modified post-setup. The automation will run upon creation.



  5. Select existing credentials from prior automations, which are stored in our Integrations module, or create new credentials.



    Creating new credentials requires that you provide the Connection URL from your targeted Databricks account.



  6. When finished, click the Create automation button. The automation will be executed and you will be navigated back to the Automations list screen.



    Tip:

    If the automation shows an Error status, check and update your credentials.



  7. Your automation is now running and ready to populate your AI governance inventory. Agents, models, and datasets discovered during the scan can be found in the AI agents, Models, and Datasets inventories, respectively. By default, the next sync will occur one month from the creation date. You can customize the sync frequency after setup to daily, weekly, monthly, or yearly as needed.

GCP Vertex Automation

Discoverable Resources

  • Agents

  • Models

Prerequisites

The following details are needed from your GCP service account to help populate the OneTrust credentials.

  • Downloaded private key

  • Key ID

  • Email

  • Unique ID

Provide the following permissions to all projects that you intend to scan for agents and models:

  • dialogflow.agents.list

  • aiplatform.models.list

The following APIs must be enabled for all projects that you intend to scan for agents and models:

Note:

Instead of enabling the APIs for each project, you can use Terraform templates to dynamically propagate this enablement.

Automation Setup

  1. On the AI Governance menu, select Setup > AI automations. The AI Automations screen appears.

  2. Click the Set up automation button. The Set up automation modal appears.



  3. Select the GCP Vertex tile.



  4. The modal will update with automatically generated details for this new automation. The automation name defaults to "GCP Vertex_" with a random, system-generated alphanumeric ID. Example: GCP Vertex_BHFNFGo

    Note:

    The automation details are set to default and you can modify them later in the automation page. These can be modified post-setup. The automation will run upon creation.



  5. Select existing credentials from prior automations, which are stored in our Integrations module, or create new credentials.



    Creating new credentials requires that you provide the details from your targeted GCP service account.



    Field
    Description
    Client ID

    Provide the Unique ID from the service account.

    Private key

    Paste the downloaded key. Example:

    CODE 
    -----BEGIN PRIVATE KEY-----\<key>\n-----END PRIVATE KEY-----
    Client email

    Provide the Email from the service account.

    Private key ID

    Provide the Key ID from the service account.

  6. When finished, click the Create automation button. The automation will be executed and you will be navigated back to the Automations list screen.



    Tip:

    If the automation shows an Error status, check and update your credentials.



  7. Your automation is now running and ready to populate your AI Governance inventory. Agents discovered during the scan can be found in the AI agents inventory, while models can be found in the Models inventory. By default, the next sync will occur one month from the creation date. You can customize the sync frequency after setup to daily, weekly, monthly, or yearly as needed.

Microsoft Copilot Automation

Important:

The Microsoft Copilot Automation feature is under Public Preview. Please contact OneTrust Support to request early access.

Discoverable Resources

  • Agents

Prerequisites

The integration requires configuration in two independent layers, and both must be completed for the integration to work successfully.

Layer 1: Entra ID (Azure ID)

  • Access to a Microsoft Entra ID app registration (service principal) with a valid client secret or certificate.

  • Ability to add API permissions and grant admin consent in Entra ID, or access to an IAM team that can do so.

The service principal must be granted the Dataverse API permission shown below.

Setting

Value

API

Dynamics CRM

Permission

user_impersonation

Type

Delegated
Note:

Although the permission type is shown as Delegated, it is still required for this integration. Dynamics CRM does not expose an Application permission type, so the client credentials flow works by combining this permission with tenant admin consent and a Dataverse Application User mapped to the service principal.

Important:

Admin consent should be granted for the tenant after adding the permission. Without admin consent, the service principal may not be able to request tokens for Dataverse even when the permission appears in the app registration.

Layer 2: Dataverse (Power Platform)

  • Access to Power Platform Admin Center to create Application Users and manage security roles.

  • The target Dataverse environment URL (for example, https://org-name.crm.dynamics.com).

  • A tenant with Copilot Studio licensing enabled, which includes Dataverse capacity by default.

Important:

Both layers are independent. Completing one without the other will result in authentication or authorization failures. Entra ID permissions allow token generation, while the Dataverse Application User and security role control data access.

At minimum, assign a Dataverse Application User security role with the following organization-level read privileges.

Note:

Ensure that the Application User mapped to the service principal is assigned a custom or existing security role with the minimum read privileges required for agent discovery.

Entity

Privilege

Scope

Purpose

bot

prvReadbot

Organization

Read agent records

botcomponent

prvReadbotcomponent

Organization

Read agent sub-components

systemuser

prvReadUser

Organization

Resolve owner UUIDs to names

connectionreference

prvReadconnectionreference

Organization

Read connection and connector details

conversationtranscript

prvReadconversationtranscript

Organization

Read usage and conversation analytics

Automation Setup

  1. On the AI Governance menu, select Setup > AI automations. The AI Automations screen appears.

  2. Click the Set up automation button. The Set up automation modal appears.



  3. Select the Microsoft Copilot tile.



  4. The modal will update with automatically generated details for this new automation. The automation name defaults to "Microsoft Copilot_" with a random, system-generated alphanumeric ID. Example: Microsoft Copilot_gcxhp2K

    Note:

    The automation details are set to default and you can modify them later in the automation page. These can be modified post-setup. The automation will run upon creation.



  5. Select existing credentials from prior automations, which are stored in our Integrations module, or create new credentials.



    Creating new credentials requires that you provide the details from your targeted Microsoft account.



    Field
    Description
    Client ID

    Provide the Unique ID from the service account.

    Client Secret

    Provide the Client Secret from the service account.

    DataverseEnvironments

    Provide one or more Dataverse environment instance URLs. This is the environment where the Copilot agents are created. If you want to scan multiple environments, enter the values as a comma-separated list. Example: org123.crm.dynamics.com, org234.crm.dynamics.com.

    Tenant ID

    Provide the tenant ID of the service account

  6. When finished, click the Create automation button. The automation will be executed, and you will be navigated back to the Automations list screen.



    Tip:

    If the automation shows an Error status, check and update your credentials.



  7. Your automation is now running and ready to populate your AI Governance inventory. Agents discovered during the scan can be found in the AI agents inventory. By default, the next sync will occur one month from the creation date. You can customize the sync frequency after setup to daily, weekly, monthly, or yearly as needed.

FAQ

Why did my automation show success during setup but fail later?

A successful setup only confirms that the automation was created. If the automation fails later, the most common cause is incorrect credentials. To troubleshoot, review the error details in the automation record. The error messages can help identify the issue.

What kinds of attributes are collected by automations?

AI Automation collects metadata about the AI assets it discovers, and the exact attributes depend on the connected platform. In general, it can populate shared agent attributes, shared model attributes, system-specific attributes, guardrail attributes, and, for Databricks, dataset attributes. Examples include names and IDs, hosting environment, region, version, model details, deployment status, supported guardrails, and platform-specific fields such as Azure Foundry default model or Amazon Bedrock AgentCore organization. For a full list of supported attributes by platform, see Collected AI Attributes.

How do I update credentials after an automation enters an error state?

If an automation enters an error state because of a credentials issue, update the credentials with the correct values:



Can I create more than one lightweight worker node in the same tenant?

No. Only one lightweight worker node can be created per tenant.

Where can I check logs, events, or service status if something looks wrong?

Check the error details in the automation record.

How do I know whether my worker node is upgraded?

You can confirm this on the worker node tile on the AI automations screen, where the current version is displayed:



How many scans can run in parallel?

One scan per asset-scanner instance can run in parallel.