Governance Posture

Posture

Governance › Posture reads every posture check Oxelone ships and shows how your workspace stands against each. A check is a rule that reads settings or metadata and decides. Each one reads from a source: a connector such as GitHub or OpenAI, or Machines.

Every number on the page is a count of issues. A check that fails has open issues. Choosing Issues on a row opens that list, already filtered.

Open Posture

Who can do it

Posture is read-only.

You need	For
`alerts:read` (View alerts)	The page at all.
`connections:read` (View connections)	The connector columns.
`machines:read` (View machines)	The Machines column.

You need one of the last two as well. If you lack one, its column is withheld and the page says so: "Connections are hidden: reading them needs connections:read." or "Machines are hidden: reading them needs machines:read." Every role holds alerts:read and connections:read.

The two tabs

The header sums up the tab: "n failing · n passing · n not checked".

Tab	What it covers
AI posture	Checks about an AI product or agent, by risk.
Foundations	Identity, admin roles, keys, sharing and audit checks behind the AI surfaces. They are counted and drilled into the same way.

AI posture

The first section, By risk, is a table of risks against sources. A risk is one of:

Risk	What its checks read
Data reaches a model it should not	AI services switched on, file search, prompts and keys in AI tool settings
AI reaches the web and tools	Web search, MCP, code interpreter
Agents act without a person	Permission bypass, full access, auto-approved shell, Copilot CLI
AI supply chain	Prompt injection, flagged AI components, public code
Idle AI	Seats and licences nobody uses

Each cell is the worst news in it: n open when anything is failing, Passing when checks ran and none fail, Not checked when none ran. A dash means no check exists for that pair. Choose a cell to list its checks.

The second section, By AI surface, has a card per source with "n of n passing". A source you have not connected shows Not connected and a Connect link to Connectors. When you choose a cell, this section is replaced by the list of checks.

Foundations

The table is By source, with one row, Foundations: "Identity, admin roles, keys, sharing, audit".

Read a check

Each check shows a state, its name, what it means and, when it is failing, its severity, the open count (and the machines or connections it touches) and an Issues link. A check that ran on only some connections says "n of n connections". Choose Show all to go back to every check.

Not checked

A check that ran on no connection and no machine says why, always on the row:

Reason shown	Meaning
Not connected.	No connection of that connector exists.
Waiting for the first sync.	The connection has not synced yet.
Switched off on every connection.	The rule is switched off on every connection.
Its mode is off on every connection.	The rule's mode is off everywhere.
Its records are not collected — switch them on in the connection's settings.	The records it reads are opt-in and off.
This connection's credential cannot read these records.	The credential cannot reach the records. See Connectors.
Not checked on any connection.	None of the above fits one reason.
No machine has reported AI tool settings yet.	No machine has sent tool settings.
No AI components reported yet.	No machine has reported AI components.
Switched off in this workspace's policies.	You switched off or removed the provided check. See Policy groups.

When it goes wrong

You see	Why
Could not load posture.	The request failed; the reason follows.
Nothing to check yet	No connection and no machine has reported. The page says "Connect a vendor or enroll machines, and their AI posture appears here." and offers Connect a vendor and Enroll machines.
reading posture requires connections:read or machines:read in this workspace	You hold neither of the two source permissions.

With the API

Posture is in the Posture reference.