Grafana dashboards

Control Core ships reference Grafana dashboards for shadow compliance discovery, NHI activity, AI cost controls, compliance posture, and bouncer fleet operations.

Bundled dashboards

Dashboard	UID	Purpose
Shadow discovery	`cc-01-shadow-discovery`	Shadow events, discovery candidates, compliance log tail
NHI activity	`cc-02-nhi-activity`	Non-human identity decisions, agent denials, service account rate
AI cost controls	`cc-03-ai-cost-controls`	Token usage, circuit-breaker trips, model fallback routing
Compliance posture	`cc-04-compliance-posture`	Pack observation counts, gap trends, shadow vs enforce ratio
Bouncer fleet	`cc-05-bouncer-fleet`	PEP heartbeat, Policy Bridge sync lag, decision latency P99
Bouncer decisions	`cc-03-bouncer-decisions`	Legacy panel set — prefer `cc-05-bouncer-fleet` for fleet ops

Dashboard JSON lives in the customer observability package under grafana/dashboards/.

cc-02-nhi-activity

Panels: NHI decision rate by subject.type, top denied nhi_id, agent vs service account split.

Sample LogQL:

sum by (subject_type) (
  count_over_time({job="bouncer"} | json | subject_type != "" [$__interval])
)

Review: Compare to registered agents in PIP inventory weekly. Spikes in ai_agent denies → review NHI verification controls.

cc-03-ai-cost-controls

Panels: Tokens per minute, AI_TOKEN_BUDGET_EXCEEDED events, BackendTrafficPolicy fallback count.

Sample LogQL:

sum(count_over_time({job="bouncer"} |~ "AI_TOKEN_BUDGET" [$__interval]))

Review: Align with provider billing API; tune token circuit-breaking caps.

cc-04-compliance-posture

Panels: Observations per compliance pack, SHADOW_WOULD_DENY trend, enforce promotion readiness score.

Review: Use alongside Control Plane Compliance & Gaps for executive exports — Grafana for time-series; UI for clause mapping.

cc-05-bouncer-fleet

Panels: Active PEP count, stuck Policy Bridge sync rows, heartbeat age histogram, sub-5ms decision latency band.

Sample LogQL:

max by (bouncer_id) (
  timestamp({job="bouncer"} | json | event="heartbeat") - timestamp({job="bouncer"} | json | event="heartbeat" offset 5m)
)

Review: pending_in_progress_sync_rows > 0 for > 2 min → page SRE; see GET /health/policy-bridge on Control Plane API.

Import procedure

Open Grafana → Dashboards → Import.
Upload JSON from grafana/dashboards/ (e.g. 02-nhi-activity.json).
Select your Loki datasource (UID loki or map to your instance).
Save and set refresh to 30s during discovery pilots.

Troubleshooting: If panels show No data, confirm Loki retention covers your pilot window and that Bouncer traffic is flowing. Cross-check Control Plane Compliance & Gaps for SHADOW_WOULD_DENY counts. See Troubleshooting.

Align with Control Plane UI

Grafana complements — does not replace — the Sovereign Compliance Dashboard. Use Grafana for SRE time-series; use /compliance for gap cache, pack observations, and executive JSON reports.

Related: Shadow discovery hub · Observe & audit · Grafana setup