Appearance
Troubleshooting Guide
Last updated: October 9, 2026
Navigation and source checks
Current navigation uses Home, My AI tools, Shadow AI Discovery and What needs me. More contains Connect work tools, Add proof, Make a review package, Learn Briard and Recorded history, according to your role. Older video recordings may show earlier labels.
For provider approval, Google Cloud billing/API prerequisites, Salesforce installation, incomplete checks or empty discovery results, follow Shadow AI Discovery. Confirm the workplace and account first. Not enabled yet is an unchecked area, not a successful result.
Device inventory and coverage
| What you see | What to check |
|---|---|
| Fleet features or installation are unavailable | The expanded paths are separately enabled and off by default. Machine installation also needs approved signed distribution. Ask about the permitted rollout; do not substitute a ZIP or signature. |
| Coverage percentage unknown | Confirm the authority, completeness and source date of the expected-device set for every selected workplace. Resolve conflicting or unexpected devices and retired devices still reporting. |
| A collector is online but coverage is incomplete | Read each required check. Heartbeat, receipt time and source inventory age are separate; unknown source age cannot be treated as fresh. |
| A local runtime or employee home is missing | Confirm the approved loopback API is running and reachable by the collector identity, and that exact local folders are approved and accessible. Do not broaden access automatically. |
| WSL or a container is absent | Check the exact selected scope, running state and guest permissions. A Windows machine service does not automatically see employee WSL registrations. |
| A device appears more than once | Review provider identity and approved aliases. Shared names, users or IP addresses do not establish a match. Keep clone or re-enrollment conflicts visible. |
| Device-name lookup is denied | Complete fresh MFA and request an explicit workplace lookup grant. Ordinary administrator membership does not automatically reveal names. |
| Jira or a provider action has an unknown outcome | Read saved status and reconcile at the destination before creating another request. A received ticket or configuration is not proof of remediation. |
See Fleet inventory and coverage for the complete workflow. Send support only the visible reduced error, approximate time and request reference; do not send credentials, patient details or a raw device export.
For Home alert-summary failures and tool-link gaps, see Briard Alert & Response Console (BARC) troubleshooting.
First checks
Before changing configuration or retrying a destructive action:
- Confirm you are using the correct application URL and organization.
- Note the approximate time, page, visible message, and request ID if shown.
- Confirm your session is signed in and, for privileged work, at AAL2 MFA.
- Refresh once. Do not repeatedly submit billing, support, export, or artifact actions.
- If the problem continues, contact support with the visible message and request ID, if shown.
Never send support your password, MFA code, session token, database URL, API key, webhook secret, CUI, PHI, payment-card data, or raw customer production content.
Sign-in and MFA
| Symptom | Likely cause | Resolution |
|---|---|---|
| Confirmation link returns to the sign-in page | Link expired or was already used | Request one new confirmation email. Contact support if the new link also fails. |
| Password-reset email does not arrive | Address mismatch, spam filtering, SMTP/provider issue, or rate limiting | Wait several minutes, check spam, then request one new email. Contact support if it still does not arrive. |
| "Your session expired" | Access token expired or local session was cleared | Sign in again. Do not reuse a copied bearer token. |
| HTTP 401 on an application action | Missing, expired, or invalid session | Sign out, close stale tabs, sign in again, and retry once. Contact support if the action remains unavailable. |
| HTTP 403 after sign-in | Wrong organization, insufficient role, missing entitlement, or AAL2 required | Confirm the workspace, role, plan, and MFA state. Cross-tenant denial is expected behavior. |
| Owner/Admin cannot access tenant data | Session is AAL1 | Open Account -> Multi-factor authentication, enroll or verify TOTP, and return with an AAL2 session. |
| TOTP code is rejected | Device time drift, wrong account, expired code, or factor not enrolled | Enable automatic time on the authenticator device, wait for the next code, and verify the account label. Contact support for recovery if the factor is lost. |
System registration and questionnaire
| Symptom | Resolution |
|---|---|
| Create registry record remains disabled | Complete every required field, choose at least one data class, select hosting and boundary status, and enter at least 200 purpose characters. |
| "Regulated-data-like content detected" | Remove CUI, PHI, customer records, secrets, source code, prompt/output content, and other raw payloads. Replace them with a classification, approved reference, owner, date, or control description. |
| "None sensitive" is removed when another class is selected | This is expected. "None sensitive" cannot be combined with PII, PHI, CUI, FCI, or another sensitive class. |
| A framework question is missing | Confirm the applicable pack is selected for the system and the subscription includes that pack. Refresh entitlements after any billing change. |
| A saved answer appears only attested | Attach approved evidence to the specific saved answer. An assertion without linked evidence remains attested by design. |
Evidence upload
Supported files
PDF, CSV, XLS, XLSX, DOC, DOCX, PNG, JPG, and JPEG are supported up to 25 MB. The extension must match the file's MIME type, and the filename cannot contain path separators.
| Symptom | Likely cause | Resolution |
|---|---|---|
| "No saved answers yet" | Evidence must support an existing answer | Open an AI system, save at least one mapped answer, then return to Evidence upload. |
| "Unsupported evidence type" | Extension/MIME mismatch or unsupported format | Export the file to a supported format. Do not merely rename the extension. |
| File exceeds 25 MB | Object and scanner limit | Create a smaller, approved extract or split the evidence outside Briard-AI. Do not remove required context or integrity information. |
| Evidence upload returns HTTP 4xx | Upload authorization expired or the file does not meet the visible requirements | Confirm the file type and size, request a new upload, and retry once. Contact support if it fails again. |
| Scan remains pending | Scanner or sealing process has not completed | Wait briefly and refresh. Do not rely on or export the file until it reports Scan passed. |
| File-safety review failed | The safety check could not complete or the uploaded file did not pass validation | Do not keep retrying the same request. Confirm the local file is unchanged, then retry once with a new upload. Contact support if it fails again. |
| File quarantined | Malware or restricted active content detected | Do not download, repackage, or bypass the finding. Follow your incident procedure and contact the security team. |
| Evidence is missing from another workspace | Tenant isolation | Confirm the organization. Evidence never moves between organizations automatically. |
Governance readiness and TRAIGA Cure Binder
| Symptom | Resolution |
|---|---|
| Readiness shows Not assessed | Save an answer for the mapped question. |
| Readiness shows Attested | The answer exists but no qualifying evidence is linked. Attach evidence if appropriate. |
| Readiness shows Partially evidenced | Some supporting elements exist, but the mapping is incomplete. Open the item and review the listed controls and evidence. |
| Readiness shows Gap | The selected answer does not meet the deterministic acceptance rule or required support is missing. Assign remediation and record the corrected state when complete. |
| Review/test form will not save | Required scope, method, findings, date, or discovery summary is missing or too short. Complete the visible required fields with metadata-only content. |
| Cure Binder is unavailable | TRAIGA entitlement, a selected system, or a required hosted service may be unavailable |
Binder says counsel_review_required | Expected legal boundary |
Artifact and ledger issues
| Symptom | Resolution |
|---|---|
| Artifact generation returns 403 | Confirm plan entitlement, system access, role, and MFA. |
| Artifact generation returns 503 | A required hosted service is temporarily unavailable |
| Download returns 404 | Wrong organization, artifact ID, or removed record |
| Download fails SHA-256 verification | Stored object does not match its manifest |
| Ledger verification reports a divergence | An event is missing, reordered, or altered |
| Ledger verifies cleanly but content is disputed | Integrity is not truth |
Billing and entitlements
| Symptom | Resolution |
|---|---|
| Checkout button is unavailable | Initial Checkout requires a confirmed Owner and a valid plan selection; Solo also requires a framework choice |
| Payment completed but access is unchanged | Signed webhook and entitlement synchronization may still be processing |
| Billing Portal is denied | Portal access requires Owner/Admin and AAL2 |
| Plan is active but an artifact or system capacity is unavailable | Pack or paid-capacity entitlement mismatch |
| Partner plan cannot be purchased in self-service Checkout | Expected behavior |
Support, export, and deletion requests
- If a support request appears to fail, check Support history before submitting it again. Requests use idempotency protections.
- Workspace exports are available only to Owner/Admin sessions and use no-store download headers.
- Deletion requests are queued for identity verification and retention review. Ledger and legal-retention obligations may prevent immediate physical deletion of every record.
- Never include sensitive payloads in the request description.
HTTP and API reference
| Status | Meaning in this platform | Recommended action |
|---|---|---|
| 400 | Invalid request state | Recheck the visible form and selected workflow. |
| 401 | Authentication missing or invalid | Sign in again. |
| 403 | Organization, role, MFA, or entitlement denied | Confirm workspace, role, AAL2, and plan. Do not attempt to bypass. |
| 404 | Record is absent in the authorized organization | Open the record from the current workspace navigation. |
| 409 | State or idempotency conflict | Refresh and inspect the current record before retrying. |
| 422 | Validation or metadata-only rule failed | Correct the named field, type, size, or content. |
| 429 | Rate limit reached | Honor Retry-After; stop automated retries. |
| 503 | The hosted service is temporarily unavailable | Wait briefly and retry once. If the problem continues, contact support with the time, page, and request ID. |
Contacting support
Email support@briard-ai.app with:
- organization/workspace name;
- page and action;
- approximate time and time zone;
- visible error and HTTP status;
- request ID, artifact ID, system ID, or evidence ID if shown; and
- whether the issue is reproducible.
For a suspected vulnerability, cross-tenant exposure, malware bypass, integrity failure, or credential disclosure, stop normal troubleshooting and email security@briard-ai.app.