SAFE Agent

Product Security Operations

Define the outcome. Review the scope. Track the evidence.

Product Model: checking configuration Choose a product to see its pipeline

Attach architecture draw.io, XML, C4 Markdown or text

Guided setup

Complete these steps once, then operate SAFE from the Operations view.

1 AI provider
2 Connector
3 Product mapping
4 Gate policy
5 First review

1. Configure analysis providerNot checked

Ollama stays local. Cloud providers require their API key and, where applicable, an endpoint/deployment.

Provider Model Endpoint Deployment API key

2. Register a connector0 configured

Choose a connector type to see its expected URL, authentication, scope, and capabilities.

Name Type Provider Base URL Authentication Credential reference Webhook secret reference Enabled

Allowed scope (JSON) Policy (JSON)

Name	Type	Capabilities	Configuration	Actions

3. Map a product to its delivery pipeline0 mapped

Product key Display name Repository Owning team Pipeline reference Default branch Scan profile Jira project

Product	Repository	Team	Pipeline

4. Define the CI security gate0 policies

Name Scope Blocking severities Maximum findings Only new findings Active

Name	Scope	Blocks	Status

5. Run the first product-security reviewNot run

Product Intent Create Jira tickets

Operations

Current security posture and execution history for your workspace.

Daily triage

Findings

Severity	Finding	Source	Occurrences	Last seen

Runs

Type	Status	Created	Gate

Connector actions and delivery history

External actions run only after explicit confirmation.

Connector Action Target / project / subject Branch / severity / recipients

Message or parameters I confirm this may change an external system.

Analysis sessions

Title	Type	Messages	Last activity

RTAN

Red Team Arsenal Navigator work dispatched by DSPP and executed by SAFE.

DSPP closed loop

DSPP owns request, approval, scope, and finding ingestion. SAFE executes the approved offensive-scan plan and reports the result back to DSPP.

Tracked RTAN work

DSPP aligned

Recent RTAN runs

Filtered to offensive-scan runs from this workspace.

SAFE run	Status	DSPP correlation	Target	Tools	Callback	Created

Administration

Identity, integrations, governance, evidence, and audit controls.

Tenant capacity and quotas

Limits are enforced across every workspace in this tenant. Usage windows use UTC.

Loading

Pipeline runs / day Chat requests / hour Connectors Users Findings retained

Users

UsernameEmailTemporary passwordRole

User	Role	Workspace	Status

My multi-factor authentication

Checking…

DSPP analysis connection

Store a credential reference, never the DSPP API key itself. Local or private endpoints require the explicit development override.

DSPP base URLCredential reference

Daily security briefing

Schedule a tenant-scoped summary of new findings, SLA risks, failed runs, blocked gates, and posture trend.

Not configured

Schedule (cron)Five fields: minute, hour, day, month, weekday. Timezone Minimum severity Retries after failure Delivery connectorsChoose configured Slack, Teams, or email connectors. Product keys Email recipients Enable scheduled delivery

Compliance evidence

FrameworkProduct key

Audit and SIEM

Sequence	Event	Outcome	Actor	Time

AI quality routing

Automatically use the highest-quality providerTask types

SSO and SCIM

Checking OIDC configuration…

SCIM token description

Description	Created	Last used

Sign in

Product Security Operations

Guided setup

Operations

Daily triage

Findings

Runs

Connector actions and delivery history

Analysis sessions

RTAN

DSPP closed loop

Tracked RTAN work

Recent RTAN runs

Administration

Tenant capacity and quotas

Users

My multi-factor authentication

DSPP analysis connection

Daily security briefing

Compliance evidence

Audit and SIEM

AI quality routing

SSO and SCIM