Docs/Shadow Ai/Dashboard

Understanding the Dashboard

Shadow AI appears in ANTS Platform as the Discover AI group in the sidebar. This page explains each view and the concepts behind the numbers.

ℹ

Discover AI requires an Enterprise plan. Without it, the Discover AI pages show a preview instead of your data.

The Discover AI views

Sidebar item	What it shows	Details
AI Usage Intelligence	Organization-wide AI adoption: active users, coverage, sessions, interactions, tokens, trends, categories and departments. A second tab, AI Activity graph, shows who uses which tools and models, and a third, Direct provider traffic, lists devices calling AI provider APIs directly.

AI TrailMaps also appears in this group when it is enabled for your deployment.

Settings for Discover AI live in Settings under Discover AI, Tool Registry and Deployment & Keys. Directory sync lives in Organization Settings > Integrations. See Directory Integration.

Shared filters

Most views share a filter bar at the top of the page:

Time range: Last 7 days, Last 15 days, Last 30 days, or a custom range. Your plan can limit how far back data is available; the custom range picker warns you when a range reaches past that limit.
AI tools, AI tool categories, OS and Department: each view shows the filters that apply to its data. For example, AI Usage Intelligence offers AI tool categories and Department, and Devices offers OS.

The time range and filters carry over as you move between views.

Core concepts

Term	Meaning
Sanction status	Your classification of a tool: Sanctioned, Tolerated or Unsanctioned. A detected tool nobody has reviewed shows as Unsanctioned. See AI Tools, Registry & Policy.
Risk	The risk level of a tool. The registry supplies a default and you can override it.
Source	Which client reported the activity: the macOS agent, the Windows agent, a browser extension, or Tracing OTEL for coding agents and other agents that send OpenTelemetry.
Session	One distinct use of an AI tool. A desktop app session, a command-line tool run in which real work happened (prompts, tool calls or tokens), or a browser chat in which at least one prompt was sent.
Interactions	Prompts sent to AI tools. Each tool uses the most accurate count available.
Uploads	Files sent to an AI tool, recorded as file name, size and type. File contents are never read.
Persona	A label derived from the category of the tool a person uses most, for example coding tools, chatbots, search, writing or design tools. Personas are usage labels, not access roles.

ℹ

Discover AI reports what it sees and does not block tools. In Warn mode the browser extension shows a banner when someone opens an Unsanctioned tool. Observe mode, the default, shows users nothing.

AI Usage Intelligence

The landing page of Discover AI. KPI cards for Active AI users, AI coverage, AI sessions, AI interactions, AI tokens and Est. AI spend, followed by an activity trend, usage by category, a tool landscape, an activity heatmap, the interaction sanction split, top apps and agents, and a Departments section.

Full reference: AI Usage Intelligence.

AI Tools

The inventory of AI tools detected in your organization. A strip of headline figures sits above the tabs: Apps Discovered, Categories, Top AI App, Top CLI Tool and Unsanctioned.

Tab	What it lists	Details
Web AI Tools	Browser-based AI tools detected by the extension. Columns include risk, sanction, category, users, interactions, uploads, first seen and last active.	Registry & Policy
Desktop Apps	Desktop and IDE AI apps such as Cursor, Windsurf and Claude.	Desktop Apps & CLI Tools
CLI Tools	Command-line AI tools such as Claude Code, Codex CLI and Gemini CLI, with sessions, devices, tool calls and tokens.	Desktop Apps & CLI Tools
MCP Servers	MCP servers and plugins configured or called from AI tools on macOS devices.	MCP Server Inventory
AI Agents	Every agent that sends traces to ANTS Platform, with users, sessions, requests, tokens and cost.	AI Agents
Non-AI Tools	Ordinary web apps your organization registered for time tracking. This tab appears only when non-AI tool tracking is enabled for your deployment.	Non-AI Tools

The endpoint tabs offer All risk levels and All statuses (sanction) filters plus a search box. Select a row to open the tool's detail panel. From there you can set the tool's sanction status and risk, if you have write access to the AI Tools inventory.

File uploads

On the Web AI Tools and Desktop Apps tabs, select a tool's upload count to see the files sent to it. The list shows the time, file name, size, type, how the file reached the tool (for example Desktop drag-drop, Desktop file picker, CLI read or MCP read), the user and the device. You can open the same list as a full page, titled Files uploaded to the tool, to scroll through large volumes.

⚠

Files are recorded as metadata only: name, size and type. File contents are never read or stored. See Data & Privacy.

Non-AI Tools

When enabled for your deployment, you can register ordinary web apps by hostname under Settings > Tool Registry > Non-AI Tools. The browser extension then records time on those sites. The Non-AI Tools tab shows users, Focus time (active time with idle, screen lock and tab switches excluded), Total usage and Last accessed. For these apps the platform keeps only the site address and path. It drops the query string and the page title.

Users

AI usage broken down by person.

KPI cards: Active AI Users (people who used at least one AI tool), Heavy Users (at least twice the median user's interactions plus uploads, with a minimum of 100), Avg Interactions/User and Total Sessions (across Discover AI and Tracing OTEL).
Table: User, Graph, Persona, Source, Department, Apps, Agents, Interactions, Sessions, Est. Cost and Last Active. Search by name, email or app.
Filters: AI tools, AI tool categories, OS and Department.

Select a user to open their page. It shows headline figures (AI apps used, AI agents, agent spend, devices, sessions, files uploaded, bytes uploaded and focus time), Risk Posture, Detection Method, Daily Activity, an Activity Heatmap, Devices, AI Tools Used, Network Activity (macOS), Desktop AI Usage, Terminal AI Usage, Browser AI Usage, Recent activity and Models used. Select a session to see its details, for example the executable and arguments of a command-line session, or the page URL and title of a browser event.

Department, job title and manager come from the enrollment script or from Directory Integration.

Devices

Each enrolled device with its installed clients, versions, health, last check-in, owner and authentication status. Device actions such as block and delete are available from the device detail panel.

Full reference: Devices.

Who can see what

Access is controlled per view by role permissions:

Role	Discover AI access
Owner, Department Admin	View all Discover AI pages, set sanctions, and manage settings, keys and directory sync.
Security & Compliance, Cost Analyst	View all Discover AI pages. No changes.
Manager Viewer, End User, Auditor	No Discover AI access by default.

Custom roles can grant each part separately: Adoption Overview, AI Tools inventory, Users, Devices, Usage Intelligence, Discovered AI agents, and Configure (policy, registry, keys, directory). See Members & Roles.

Next steps

AI Usage Intelligence: KPI definitions and every chart.
AI Tools, Registry & Policy: classify what you see here.
Directory Integration: group usage by department and manager.
Data & Privacy: exactly what is and is not collected.