Read-Only to Governed
An AI governance agent, built on the IBM watsonx stack, that connects into CredHound, AIM’s multi-tenant Azure governance platform, to find cost waste and access risk across a client’s tenant and propose a fix, while a named person remains the only one who can approve it.
Read-only finds a problem. It doesn’t fix one.
CredHound, AIM’s multi-tenant Azure governance platform, is read-only today. It monitors app registration secrets and certificates, and optionally Key Vault objects, across a customer’s connected Microsoft Entra tenants, and alerts an administrator by email before something is due to expire. It stores only expiry metadata, never secret values, and never changes anything in a client’s tenant.
That is useful, but it stops short of the two things cloud teams spend the most money and carry the most risk on: waste sitting in idle or orphaned resources, and access that is broader or older than it needs to be. Finding those problems, and fixing them, has so far meant a person going looking, tenant by tenant.
The design question: how to let an AI agent find those problems and propose a fix, without ever letting it make a change on its own.
Build the agent on IBM watsonx. Gate every change.
Connect to the platform, don’t replace it
Build the new cost and access governance agent on IBM’s stack, and connect it into CredHound’s existing data model, API, and database rather than standing up something parallel.
Build an agent that can reason, but not act
The cost and access AI agents run on IBM Code Engine and connect to watsonx Orchestrate. They call CredHound’s own APIs as tools, hold no Azure credentials of their own, and can read findings and propose a fix, but cannot apply one.
Gate every change behind a named human approver
Every proposed fix runs a pre-flight check, a policy test, and a blast radius cap, before it is shown to anyone, then waits for a person holding the Governance.Approver role to approve it. The person who proposed a change can never be the one who approves it.
An IBM watsonx agent, five components, one approval gate.
Cost governance
Points to specific waste, with a credit-aware view of true cost where the billing account supports it.
The cost AI agent, running on the IBM watsonx stack, gathers spend signals from Azure Advisor, Resource Graph, Cost Management, and Monitor via CredHound’s APIs, and can point to specific waste, such as an idle virtual machine still billing for its disk. Where the billing account supports it, it also shows a credit-aware view of true cost and an estimated runway.
Access governance
Flags access that is broader than needed or has gone unused.
The access AI agent gathers signals from role assignments, the Activity Log, and Entra sign-in and audit data through the same connection into CredHound, and can flag access that is broader than needed or has gone unused.
The approval gate
A proposed fix is never applied by the agent; a named human approver must sign off.
A proposed fix is held until a named person holding the Governance.Approver role approves it, a role only CredHound’s platform Administrator can grant. Self-approval is refused, and an approver must have recently re-confirmed their role before an approval is accepted.
Connecting a client tenant
One-time organization-level consent, then role-based access that revokes immediately.
A customer’s administrator grants organization-level consent once, during a Connect Tenant flow inside CredHound. After that, the platform Administrator assigns specific users the internal Governance.Viewer or Governance.Approver role, and revoking that role blocks the next request immediately, with no further configuration change.
An immutable audit trail
Every action, and the person who approved it, is written to a tamper-evident record.
Every action the IBM watsonx agent takes, and the person who approved it, is written to a tamper-evident record in immutable storage.
What’s fixed by design, regardless of delivery phase.
No agent acts alone
The IBM watsonx agent can find a problem and propose a fix, but every change waits for a named person holding the Governance.Approver role inside CredHound. A stolen or replayed token cannot make or approve a change, since approval must come from an authorized human sign-in, never a request field.
Least privilege, by design
The component that reads a client’s tenant is read-only. The component that applies an approved change holds two narrow custom roles and never holds Owner.
Built to move
The agent layer runs on IBM Code Engine and watsonx Orchestrate for this phase, but it is designed to be portable, able to move to Azure AI Foundry later with no change to CredHound’s own APIs.
Read-only first. The write path comes gated.
Read-only cost and access findings, plus the true cost view. Azure Advisor must be enabled and needs a few days of history before cost findings populate.
The change path: propose, pre-flight, approve, apply, verify, and roll back. Introduces the write-capable execution identity. Role removal and disk deletion are later tiers.
Deeper access accuracy from Microsoft Defender for Cloud, at no added cost when a customer already has it licensed.