Resource Enrichment

Audience: Control authors, platform engineers Time: ~10 min Prerequisites:

• A registered resource (how to register).
• A user account with the Resource Manager or Admin role.

What resource enrichment is

Resource enrichment means attaching structured, operator-approved metadata to a protected resource row in the Control Plane (beyond the hostname or URL the Bouncer discovered). That metadata describes what the workload is for the business, how sensitive it is, who owns it, and—when relevant—how it participates in AI or agent flows. It is not a substitute for Rego controls; it is context those controls and tools can consume.

Why enrich resources

• Policy and controls: Enrichment fields flow into the data.resources feed so Rego can branch on classification, compliance tags, PII categories, residency, and similar attributes without hardcoding hostnames in policy.
• Authoring assistance: SCCA and suggested-controls endpoints use the same metadata to propose templates and safer defaults aligned with how you classified the workload.
• Operations and audit: Audit rows and inventory views carry human-meaningful context (owner team, business description, regulation tags) for triage and evidence, without scraping upstream traffic for labels you already know.

How to do it in the Control Plane

1. Sign in and open Settings → Resources (pick Inventory Dashboard or Manage Resources as needed).
2. Locate the resource (auto-discovered rows show an Auto-Discovered badge; the inventory Needs attention table surfaces gaps).
3. Choose Enrich (or Edit for manual resources), complete the form, and Save. Values are validated (for example, owner_email format and business_context length).
4. Confirm propagation: enrichment is published for policy evaluation through the usual Control Bridge path; use Audit filtered by resource or the inventory Refresh action if you need to confirm downstream picks up the snapshot.

Troubleshooting: If Enrich is missing, your account may lack resources:edit. Ask an admin to confirm Settings → Users & Roles.

When to enrich

Enrich a resource as soon as one of these is true:

• It just appeared via auto-discovery (look for the Auto-Discovered badge in Settings → Resources → Manage Resources).
• The Inventory Dashboard's Needs attention table flags it.
• You're about to author your first control for it — the Visual Builder + SCCA prompts both read enrichment.

Troubleshooting: No Enrich button? Make sure your role grants resources:edit. Re-check via Settings → Users & Roles.

Enrichment field map

Fields fall into three groups. You can fill any subset; empty fields are simply absent from the OPA input.

Operator-curated metadata (used by every surface)

AI / Agentic context (only meaningful for AI surfaces)

Classification metadata (set by the system)

classification_source, classification_confidence, last_classified_at, tags — these are written by Auto-Classification and the manual Apply Classification action; you usually don't edit them by hand.

Step-by-step (Visual Builder)

1. Open the Enrich modal. Settings → Resources → Manage Resources → click the resource → Enrich. (2 min)
2. Fill the metadata fields. Use the field map above. The form validates owner_email (regex), business_context length (≤500), and requires at least one compliance tag when classification is confidential or restricted. (5 min)
3. Save. The modal closes, the row updates in place (no full page reload), and an audit entry is written. (immediate)
4. Review suggested controls. A panel appears with template suggestions tied to your enrichment. Click any one to open the Policy Builder pre-filled with ?template=<id>&resource_id=<n>. (2 min)
5. Verify in the audit feed. Audit → Filter by resource = <name>. The newest row carries event_context.resource_snapshot.version = 1 with all the fields you set. (1 min)

Troubleshooting: Save succeeded but suggestions stayed empty? Refresh the inventory summary (Inventory tab → Refresh). Suggestions are deterministic on enrichment input; if a field you expect to drive a template is missing, set it and re-save.

Step-by-step (Bulk via API)

curl -X PUT \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "data_classification":"confidential",
    "compliance_tags":["HIPAA","PCI-DSS"],
    "owner_team":"billing",
    "audit_level":"detailed",
    "ai_provider":"openai",
    "pii_categories":["card_numbers","emails"],
    "resource_kind":"llm_endpoint"
  }' \
  https://controlplane.example.com/api/resources/42/enrich

Returns 200 OK with the updated resource and an impacts array describing what changed. The Control Plane data feed picks up the new values on its next poll (default 30s).

Where enrichment is consumed

Troubleshooting: Authoring a Rego rule that reads data.resources[input.resource.id].pii_categories returns undefined? The data feed is updated only when at least one resource has the field set. Confirm via curl https://<control-plane>/api/resources/inventory-summary — if the field is missing in the response, the Bouncer hasn't loaded a snapshot that includes it yet (try Refresh on the Inventory tab to force a write that triggers a sync).

Next steps

• Inventory Dashboard tour
• How auto-classification proposes values
• Templates that enrichment unlocks