Product capabilities
Your organisation owns the controls over reachable tools, credentials, shared state, and delegated authority. 3LS brings discovery and visibility into one operating surface, then connects inventory, policy decisions, approvals, cases, and evidence.
3LS applies controls at supported browser, API gateway and managed MCP integration points. Available controls depend on the channel, inspected fields and configured policy.
Operating surface
The useful feature is not another dashboard tile. It is the connection between what was found, which policy applied, what happened next, and what an operator can prove.
Discover observed AI products, provider accounts, MCP installations and tool revisions. Track ownership, provenance and observation freshness.
What is installed, where did it come from, and is it still active?
Apply policy to approved providers, models and tool groups. Inspect selected text and control usage on supported traffic routed through the gateway. Configure approved provider accounts, model routes and tool groups for governed requests.
Which models and tools are permitted for this governed request?
Validate and publish signed policies, track their application, and manage scoped exceptions with approval and expiry. Request and approve case-linked exceptions with defined scope and expiry.
Which policy made this decision, who changed it, and where is it active?
Prioritise findings, assign case owners and retain evidence of remediation. Inventory findings include a versioned 0–100 risk score. Review the finding and its evidence, record actions and retain remediation evidence.
Which exposure needs attention now, and what proof closes it?
Review attributable policy decisions, activity and case history. Export observed inventory for governance and assurance reviews. Central inventory and audit records use bounded metadata, argument hashes, redacted fields and tenant-scoped identifiers. Raw prompts, secrets, or local transcripts are not collected into those records by default.
What evidence supports this decision and who may access it?
Apply provider, model, tool and selected-text policies to supported requests routed through the gateway. OpenAI and Anthropic API traffic can use the governed route; direct provider or backend access requires separate controls.
Check original tool arguments before backend dispatch and inspect returned results before delivery. On supported managed MCP stdio paths, typed action classification identifies read, write, delete, admin, execute, or unknown operations and supports grant or deny before downstream, with journalled outcomes and at-most-once handling. Result denial cannot undo an effect already executed.
Inspect selected prompt text on supported ChatGPT and Claude browser sites. Conversation-history inspection depends on policy. Upload controls use file metadata, not file contents. Available controls depend on the channel, inspected fields and configured policy. Browser delivery and enrollment need to be agreed for the deployment.
Sensitive-data and prompt-risk detectors inspect supported observable channels for PII, PHI, financial data, credentials and secrets, and infrastructure patterns. Prompt classification and jailbreak, role-override and policy-evasion signals support review. Detector evidence does not certify compliance or explain a vendor model’s learned reasoning.
Integrations
3LS evidence does not have to end in a separate queue. Connect it to the systems your SOC, governance team, and service owners already use.
Enterprise integration requirements. Named connector compatibility, deployment and connector availability must be confirmed during solution design.
Explore enterprise security integrationsSplunk, QRadar, and Microsoft Sentinel
Put findings and audit evidence beside the rest of the security estate.
Phantom and Demisto
Carry 3LS events into existing triage and response playbooks.
ServiceNow and Jira
Route ownership, remediation, and follow-up through established queues.
APIs and webhooks
Connect inventory, evidence, and response data to internal workflows.
We will map the endpoint, AI or MCP association, policy decision, approval path, evidence, and integration handoff with your team.