AI Assets Collector¶
The AI Assets Collector collects AI-related assets from your data sources, builds an inventory, and captures relationships between those assets for AI Governance.
For how collectors fit into Trust3’s deployment model (control plane vs data plane, API server, and API key authentication), see Control plane and data plane.
Discovery and monitoring¶
Each platform you connect has up to two independent switches:
| Switch | What it does |
|---|---|
| Discovery | Inventories that platform's AI assets and adds them to your inventory |
| Monitoring | Collects traces from those assets and runs them through the classify, evaluate and summarize pipeline |
Monitoring requires discovery. Traces are attached to assets, so a platform whose discovery is off collects no traces even if its monitoring switch is on. That is why each platform's monitoring switch only appears once you turn its discovery on.
On a new collector everything starts off — turn on the platforms you actually use. When an existing collector is upgraded, your current setup is preserved: platforms you had credentials for stay discovered, monitoring follows whatever your previous trace setting was, and you do not need to re-enter anything.
Custom agents work slightly differently. There is nothing for a collector to enumerate, because a custom agent is code rather than a registered cloud resource, so you publish those agents to the inventory from your own code using the Trust3 collector SDK. Discovery still happens — it just happens in your application rather than in the collector, which is why the Custom Agents section has a monitoring switch but no discovery switch.
Guides¶
| Guide | Description |
|---|---|
| Runtime Planes | The Kubernetes deployment in your own cloud account that collectors run in — do this first. Then Basic setup or Advanced setup |
| Run Collector | Add the collector to a runtime plane, or download docker-compose.yml, add .env under the same directory, then docker compose up -d |
| Collector Connections | Scan several Databricks workspaces and Microsoft tenants from one runtime plane: one connection each, Shared or Dedicated, on one or more shared hosts |
| Saved Credentials | Enter a secret once on a runtime plane, use it in many connections, and rotate it in one place |
| Databricks | Workspace URL, PAT, SQL warehouse HTTP path, system catalog grants for model/serving usage, and configuration mapping |
| Microsoft Copilot Studio | Microsoft Entra app registration, secrets, Power Platform app user, and least-privilege roles |
| Microsoft Copilot Studio security role | Optional custom Dataverse role with only the table privileges Trust3 needs for Copilot Studio inventory |
| Azure Foundry | Microsoft Foundry roles, Application Insights, and Monitoring Reader |
| Azure M365 Agents | Entra directory role for Agents inventory, plus Microsoft Graph application permissions for traces |
| Custom Agents | LangChain and other self-built agents: publish inventory with the Trust3 collector SDK, collect traces over OTLP |