User Guide

Last updated: October 12, 2026

This guide walks a workspace owner or governance contributor through the standard Briard-AI workflow.

Find your way around the current workspace

Navigation label	Use it for
Home	See work needing attention and, for owners/admins with Briard Alert & Response Console (BARC) access, the AI incident alert summary
My AI tools	Open a governed tool record and its answers, decisions and evidence
Shadow AI Discovery	Connect approved sources and review possible AI use
What needs me	Work through decisions and missing information
My AI policy or AI rules	Use the policy workspace or rule library available to your workspace
More	Find Connect work tools, Add an AI tool, Add proof, Make a review package, Learn Briard, Recorded history, billing and account tools according to your role

The console also offers search and a motion control. The mobile navigation keeps Shadow AI accessible; additional tools remain in the menu. Your role and enabled features determine which actions appear.

Before you begin

You do not need to understand AI governance before you begin. Briard explains each choice and lets you answer I'm not sure when an approved person needs to decide later.

It helps to know who can approve Microsoft 365 or Google Workspace access for your organization. You can also start with Browser Check, add one tool yourself, or take the fictional-data tour without an administrator.

As your work grows, prepare the following outside the platform:

• access to an approved Microsoft 365/Entra administrator for one-time discovery consent, when available;
• a list of AI systems and embedded AI features that cannot be observed through an approved connector;
• an accountable owner for each system;
• approved hosting and data-flow facts;
• the organization's boundary decision;
• applicable framework packs;
• non-regulated evidence files or HTTPS references; and
• reviewers authorized to approve governance statements.

Do not prepare or upload CUI, PHI, payment-card data, credentials, customer production records, raw prompts/outputs, source code, or secrets.

1. Create and secure your account

1. Open Create your Briard-AI account.
2. Enter the requested identity details and select Start free.
3. Open the confirmation email and complete the confirmation flow.
4. Sign in. Briard will ask you to add a six-digit code from a free phone app such as Microsoft Authenticator or Google Authenticator.
5. Scan the square code with the phone app.
6. Enter the six-digit code shown on your phone.
7. Save recovery information according to your organization's password and recovery policy.

This second sign-in step protects workspace owners and administrators. Never share a session, password, recovery code, or phone-app setup key.

For coworkers using the same inventory and policy workspace, follow Invite your team and manage workspace access. The workspace creator is its Owner; additional people join by invitation with Admin, Contributor or Viewer access.

2. Start your 30-day free trial

Open your workspace after confirming your account. The trial starts when the workspace first opens.

• No payment method is required.
• The trial lasts 30 days and includes Professional features for up to ten AI systems.
• The trial does not renew or create an automatic charge.
• A verified owner chooses a paid plan only if the organization wants to continue afterward.

You can open Billing at any time to see the days remaining or voluntarily subscribe early. You do not need to visit Checkout before finding and governing your AI tools.

Review Shadow AI and incident alerts

Open Shadow AI Discovery to connect and review the broader work-source categories, with the correct workplace selected. Follow the Shadow AI guide for approval, provider prerequisites, first-check status and confirmation.

When enabled, Device and model inventory shows current reported software separately from governed tool records. Use Check fleet coverage to compare required checks with an approved expected-device register, and Review discovered AI to assign scoped review tasks. See Fleet inventory and coverage for multi-site administration, local checks and the availability limits of the expanded workflow.

On Home, AI incident alerts shows active BARC counts by priority and category and up to three alert links. Select Review or Open BARC alerts to continue through the protected handoff. A failed summary is unavailable, not zero alerts. A zero count does not establish that every AI tool is monitored. See Alerts and real-time response.

Automatic AI discovery

Open More > Connect work tools for the Microsoft 365, Google Workspace or Browser Check setup path. For broader discovery categories, start in Shadow AI Discovery. Choose the source your organization uses. Briard asks for the simplest available approval and fills in the organization identifier when the provider allows it.

1. Choose Microsoft 365, Google Workspace, or Browser Check.
2. Select Find my organization ID when Briard offers it. You do not need to search an administrator console first.
3. If approval is required, sign in as an authorized administrator or select Send to my IT person. The approval page explains the read-only access before anything is connected.
4. Briard verifies the connection and checks approved metadata. Browser Check reviews only the browser information and services you approve.
5. Review one suggested tool at a time. Choose Yes, we use this, No, not ours, or I'm not sure.
6. Open Home. Approved connections can check again automatically, and an owner can request a fresh check when needed.

Briard reads only the organization or browser metadata explained on the connection screen. It does not collect email or chat message content, files, prompts, model outputs, or regulated payloads.

The Microsoft/Google automation path can add likely AI services automatically as Discovered - unverified records. Other Shadow AI findings use an explicit confirmation and Add to AI inventory step. Expanded device inventory refreshes reported instances from accepted evidence. These paths do not approve an AI tool: an accountable person still supplies and reviews ownership, purpose, permitted data and boundary decisions that source metadata cannot prove.

No connector can guarantee discovery of every AI use. Browser-only tools, unmanaged personal accounts, local models, API keys hidden from approved sources, and services outside the connected tenant require other approved connectors or manual reporting.

If your organization uses more than one network or environment, return to Connect work tools for each approved source. Give each place a plain name such as Main office, Secure project, or Test lab. Briard shows one place at a time and keeps that place's percentages, answers, proof, findings, tasks, and packages separate. Older records without a place show Name this place; naming one does not delete or rewrite its governance history.

See the Automation Setup Guide for permission purposes, consent behavior, collection boundaries, revocation, and troubleshooting.

3. Register an AI system manually

Open More > Add an AI tool. The current wizard asks one question at a time:

1. What is the tool called? Enter the tool name and provider. Use the optional Add an agent or connection service details only when that is the record you need.
2. What do people use it for? Write one factual sentence, name the workplace and choose who uses it. Briard prepares the longer purpose record from these answers.
3. What kind of information may it use? Select the applicable categories or I'm not sure. Describe permission and intended use; do not enter real customer information.
4. Confirm your first AI record. Check the generated summary. Expand Review details to correct the owner, model, hosting, security boundary, framework choices or generated purpose record.
5. Select Confirm and create record and review the saved record in My AI tools.

The generated purpose record must still be complete enough for review. If you edit it, keep the business purpose, permitted information, prohibited uses and human-review expectations accurate. Unknown answers remain follow-up work. Selecting an information category is not permission to upload that information to Briard.

4. Answer mapped questions

1. Open My AI tools and select the system.
2. Review each question's category, help text, and mapped control codes.
3. Select the answer that reflects the approved current state, not the desired future state.
4. Add metadata-only explanation where the question permits free text.
5. Select Save answer and wait for the saved result. Typing changes a draft on your screen. If saving fails, keep the draft open and select Save answer again. A draft does not change the saved decision or evidence state.
6. Review any rule finding and remediation options.

Understanding coverage

• Not assessed: no current answer.
• Attested: an answer exists, but qualifying evidence is not linked.
• Partially evidenced: some support exists, but the mapped requirement is incomplete.
• Evidenced: the answer and linked support satisfy the deterministic evidence rule.
• Gap: the answer, support, or required condition does not meet the mapped rule.

These are workflow states, not audit findings or legal conclusions.

Complete the eight Texas investigation records

For a TRAIGA-enabled system, select Review the 8 records on the AI tool page.

1. Briard opens the first unfinished record and shows progress as 0 of 8 through 8 of 8.
2. Write one short, factual answer. Categories 1 and 3 start as drafts when the registered purpose and information classes already supply reliable facts.
3. Optionally expand Add document or evidence references and enter one approved filename, evidence ID, or HTTPS link per line.
4. Select Save draft when facts still need review, or Save and mark ready when the answer is complete enough for an accountable reviewer.
5. Briard advances to the next unfinished record. Repeat until all eight are ready for review.

The eight records correspond separately to Texas Business and Commerce Code Section 552.103(b): purpose/use/deployment/benefits; programming or training data; input categories; output categories; performance metrics; known limitations; monitoring and safeguards; and other relevant documentation. Use categories and references only. Do not paste prompts, responses, customer records, credentials, or sensitive content.

5. Attach evidence

File evidence

1. Save the mapped answer first.
2. Open Add proof. Expand What can I use as proof? if you need examples.
3. Under Proof supports, choose the system and saved answer the file supports.
4. Set Check this proof again to the next review date for this material.
5. Under Proof file, select an approved PDF, CSV, XLS, XLSX, DOC, DOCX, PNG, JPG, or JPEG, no larger than 25 MB.
6. Select Add and check proof.
7. Wait for upload, SHA-256 verification, malware scanning, and sealing to finish.
8. Confirm Scan passed before using the file in the workflow. This checks file safety and integrity; it does not prove the answer is accurate or approve the AI tool.

If the result is pending, failed, or quarantined, the file is not approved for use in the workflow. Follow the Troubleshooting Guide.

HTTPS reference evidence

Where a question accepts a reference, use an approved HTTPS URL that points reviewers to the authoritative source. Do not use a URL that bypasses access controls or publicly exposes restricted material.

What can I use as proof?

A saved answer states what your team knows. Supporting material helps a reviewer check that specific answer. Choose approved, non-regulated material for the actual tool and workplace; you do not need to collect every example below.

What the answer describes	Practical supporting examples	What the material can show
Purpose, provider and setup	An approved Copilot purpose and allowed use.pdf or architecture decision record; an approved vendor service-description HTTPS link; a dated, sanitized settings export or screenshot.	The intended job and permitted use; the provider's stated service details; the actual workspace setup shown on the recorded date. A vendor page alone does not establish your tenant's configuration.
Information and safeguards	A data-category and retention record, approved acceptable-use policy, or Copilot review SOP.docx identifying the required human check.	Which information categories may be used, how they are kept, and who must check important AI work. Use categories and rules only, without actual customer information.
Checks and decisions	A completed evaluation or test summary with scope, limits, findings and fixes; a dated approval or owner record.	The checks and decisions that actually happened for the stated scope. A planned test, generated draft or undated statement does not establish a completed test or approval.

The table gives examples of document types; it does not mean Briard has approved your material. Download a fictional purpose and allowed-use record to see the level of detail. The sample is teaching material and must not be submitted as real proof. Match each file or link to the question it supports. Include the tool, workplace, accountable owner, version or effective date, and review date. For example, a purpose brief supports the purpose answer; a separate review procedure supports whether a person must check important outputs.

Use only material your organization authorizes for this workspace. Do not upload CUI, PHI, payment card data, credentials, secrets, customer production records, raw prompts or outputs, or source code. Private storage does not authorize prohibited content. Keep restricted detail in its approved repository; add only a permitted summary or authorized reference, without bypassing access controls.

A passed file scan checks file safety and integrity. An accountable reviewer still checks whether the supporting material is relevant, current, authentic and sufficient. An optional Source link or record name on a tool fact, or a filename in Add document or evidence references, records a reference; typing a filename does not upload that file or independently verify the fact.

Evidence quality tips

A strong evidence reference identifies:

• the exact control or statement supported;
• the owner and review date;
• the applicable system and environment;
• the version or effective period; and
• how a reviewer can verify authenticity.

Avoid generic evidence attached to every question without a clear relationship.

6. Review governance readiness

For a TRAIGA-enabled system, open the NIST AI RMF + TRAIGA panel on the system page.

Keep the Texas legal tracks distinct during review:

• TRAIGA does not impose a general affirmative inventory duty.
• 1 TAC Section 219.21 requires each Texas state agency and local government to designate an AI Risk Officer and establish a process to identify and inventory heightened-scrutiny AI implementations.
• Chapter 219 took effect March 18, 2026.
• Use DIR's AI code of ethics, standardized notice, and acceptable-use-policy example alongside your team's records. Briard-AI provides independent working records to support implementation and review; these are not official DIR forms or an endorsement by DIR or Texas Cyber Command.

1. Review the summary counts and the GOVERN, MAP, MEASURE, and MANAGE grouping.
2. Open each mapping to see question status, controls, evidence, and source links.
3. Resolve incorrect answers or missing evidence at the source question.
4. Do not change an answer solely to improve the score; the record must reflect the approved current state.

The panel is designed to prepare a review record. It does not state that the organization substantially complies with NIST, qualifies for a TRAIGA protection, or has completed legal analysis.

7. Record an internal review

In the readiness panel, use Record internal review:

1. enter the review date;
2. describe the metadata-only scope;
3. summarize findings;
4. select remediation status;
5. describe remediation and policy changes, if any;
6. add an approved artifact or HTTPS evidence reference; and
7. if a suspected violation was discovered, select the checkbox and provide the required discovery summary.

Records are append-only. If a conclusion changes later, add a new review rather than rewriting history.

8. Record internal testing or red-team activity

Use Record internal test:

1. enter the test date;
2. describe scope and method without sensitive payloads or exploit material;
3. summarize findings and remediation;
4. link approved evidence; and
5. record whether a suspected violation was discovered.

Store detailed restricted test material in your approved security repository and place only the authorized reference and summary in Briard-AI.

9. Generate an artifact

Open Make a review package.

1. Select the artifact type.
2. Select the applicable system.
3. Review the manifest preview, audience, template version, and ledger head.
4. Select Generate artifact.
5. Wait for the new record to appear under Recent exports.
6. Download the available JSON or PDF. A TRAIGA Cure Binder also supports ZIP.

Before external sharing:

• verify the system and organization identifiers;
• review attested, evidenced, and gap items;
• confirm evidence references are authorized for the recipient;
• verify the ledger and manifest hashes when required;
• remove or correct inaccurate source records through the documented workflow; and
• obtain the appropriate security, compliance, management, and legal review.

10. Review a TRAIGA Cure Binder

The ZIP contains:

• registry/system.json;
• assessment/readiness.json;
• evidence/evidence-index.json;
• reviews/internal-reviews.json;
• testing/testing-log.json;
• sources/framework-sources.json;
• texas/sec-552-103-investigative-documentation.json;
• customer/TEXAS_INVESTIGATIVE_DOCUMENTATION.csv;
• LEGAL_NOTICE.txt; and
• manifest.json.

The manifest lists SHA-256 and size for all 14 package members other than the manifest itself. Verify these hashes before relying on a transferred package. The binder indexes evidence; it does not automatically place every private evidence binary inside the ZIP.

11. Verify the ledger

Open Recorded history.

1. Load the current organization events.
2. Start verification.
3. Confirm the result reports a clean chain, or preserve the first divergence report.

A clean result means the event sequence and recorded hashes are internally consistent. It does not prove that an attestation was correct or approved.

12. Use Home and Learn Briard

• Use Home to see what Briard completed automatically and the focused decisions that still require a person.
• Select Run check now only when an immediate refresh is useful; the scheduled review does not require a user to press it.
• Use Learn Briard for guided workflow lessons, current documentation links and reminders about metadata-only use.
• Use Settings to review membership, billing, notification, and security paths.
• Partner-entitled users can use Partner console for client-organization workflow entry points.

Keep policy, tool reviews and agent permissions current

Publish and share an AI policy

Open My AI policy when it is enabled for your workspace. Confirm the organization answers, prepare the draft and review its sections and source references. Resolve missing facts or record an authorized dated exception; a generated draft is not an approved policy.

Choose the eligible people who must approve the exact draft. Complete the displayed approval sequence, then publish that approved version. If the draft changes, follow the renewed review requirements instead of relying on approval of older text.

Download the exact published version when needed. Before sending a reading campaign, review the recipient roster and allowed email domains. Publication, sending, delivery and a person's recorded acknowledgment are different milestones. Review delivery failures and outstanding acknowledgments in the policy workspace; a successful send does not prove someone read the policy.

Review a tool and its rules

Open More > Governance center and choose the relevant AI tool. Check this AI tool presents focused assessments with answers, evidence references, saved versions and review history. Have an eligible reviewer evaluate the exact saved answers. A proposed lifecycle step under Move to the next step remains a proposal until its required decision is recorded.

Use Rules for alerts to prepare the tool's policy, permitted actions and monitored-system context. Review and approve the saved proposal, then check its delivery status. Changed source facts may require a new version. Approval, delivery to BARC and runtime enforcement remain separate; saved governance rules do not prove an external action was blocked.

Record agent and tool relationships

In More > Agent access & vendors, select the AI record and choose the task you need: record a connection, record tool access, check the provider, or link outside proof. Record the permitted relationship or access scope, accountable review and evidence reference. Keep unknown permissions explicit. A relationship record does not prove that an agent used the connection, and a proof link does not copy the source incident file into Briard.

Bring an incident back into policy review

For an eligible closed BARC case, follow its policy-review handoff into Briard. Review what we learned retains the case's evidence references, gaps and rule versions. Compare the proposed wording with the current policy, name an owner and due date, and save it for review.

An authorized decision can Accept into draft, Revise or Decline. Accepting a suggestion changes the draft only. Complete the ordinary approvals, publication and reading campaign separately, then link those results to the incident review. The original case and prior policy versions remain unchanged.

13. Manage billing and account security

Billing

During the free trial, Billing shows the remaining days and confirms that there is no automatic charge. A verified owner can choose Solo or Professional at any time. Entering Checkout is a separate choice and is not required to use the trial.

After an owner subscribes, owners and administrators can open the Customer Portal after completing MFA. Subscription changes are reflected after signed provider events update the workspace entitlement.

Account

Use Account to:

• verify your role and organization;
• enroll or verify MFA;
• reset your password;
• open Billing or Settings;
• submit support requests;
• request a workspace export; and
• submit a deletion request.

Workspace export requires Owner/Admin access. Deletion requests require owner verification and retention review; an append-only ledger or other legal obligation may require selected records to be retained.

14. Request support

Open Support and choose the category that best matches the issue. Provide metadata-only details, affected page, approximate time, and visible identifiers. Review Support history before resubmitting.

For urgent suspected security issues, email security@briard-ai.app. For normal product help, email support@briard-ai.app.

Golden-path completion checklist

• [ ] Account confirmed and MFA verified.
• [ ] Free trial or chosen paid plan active.
• [ ] Approved discovery source connected where available.
• [ ] Automatically discovered records confirmed or rejected by an accountable owner.
• [ ] Any system not visible to approved connectors registered manually with an accountable owner and approved purpose.
• [ ] Applicable mapped questions answered accurately.
• [ ] Evidence attached only to the answers it supports.
• [ ] Evidence scan status is clean before use.
• [ ] Readiness gaps reviewed and assigned.
• [ ] Internal review and testing records appended where applicable.
• [ ] Artifact generated from the correct system and ledger head.
• [ ] Export reviewed by authorized stakeholders before sharing.
• [ ] No CUI, PHI, credentials, or prohibited customer content entered into the platform.

Back to Client Documentation