Inventory Dashboard

Audience: Control authors, platform engineers, governance owners Time: ~5 min read Prerequisites: At least one registered resource.

The Inventory Dashboard is the first tab on Settings → Resources. It shows the operator-facing health of your resource catalog as KPIs, charts, and a "needs attention" priority table — all driven by a single GET /resources/inventory-summary round trip.

The other tab — Manage Resources — is the existing table view with filters and per-row Edit/Enrich actions. The two are intentionally side by side so you can move from "what looks bad" → "fix it" without leaving the page.

KPIs at a glance

Card	Reads	Why it matters
Total resources	`total`	Baseline count for the selected environment
Protected	`protected / total`	Fraction with a Bouncer assigned — directly affects what authorization rules can enforce
Classified	`classified / total`	Fraction with both `data_classification` and at least one compliance tag — drives template recall
AI / Agentic	`ai_count / total`	Fraction whose `resource_kind ∈ {llm_endpoint, agent, mcp_server}` — surfaces AI surface area

Troubleshooting: KPI values stuck at zero? GET /api/resources/inventory-summary?environment=<env> from the API console — if it returns {"total":0,...} the environment selector points at an empty scope. Switch the top environment selector or remove the filter.

Charts

Resources by kind (donut) — distribution across api / llm_endpoint / mcp_server / agent / rag_index / dataset / tool / unknown. A large unknown slice usually means resources that haven't been classified — run Auto-classify all to fix.
Classification (bar) — public / internal / confidential / restricted / unset. The unset bar is the queue for the next enrichment pass.
Compliance coverage (bar) — count of resources tagged per regulation. Empty here means SIEM exports won't carry regulation_tags — fix in the Enrich modal.

"Needs attention" table

Lists resources that are either unprotected, unclassified, missing compliance tags, or never auto-classified. Click Enrich on any row to open the modal pre-filled. The table caps at 25 rows; clear the queue, then refresh.

Auto-classify all

The toolbar button calls POST /resources/auto-classify-bulk?environment=<scope>, which:

Selects up to 100 resources per call (configurable via ?limit=).
By default targets only resources with no classification_source or classification_source = heuristic.
Fills empty cells from the heuristic classifier output — never overwrites operator-set values.
Records classification_source = heuristic, classification_confidence, last_classified_at.
Writes a single RESOURCE_UPDATED audit row summarising the batch.

Troubleshooting: Bulk classify reports skipped > 0 and a non-empty errors array? Each error line includes the failing resource ID. The most common cause is a bad URL on the resource (the classifier extracts hostnames). Fix the URL and re-run.

Tab persistence