Inventory

Inventory is the record of every resource Sencai knows about across your connected cloud providers and enrolled servers. Policies, compliance scoring, cost allocation, and the NIS2 evidence trail all read from this same underlying data, so it’s worth understanding how a resource gets here and what state it can be in.

Find it at Compliance & Audit → Inventory in the app (/gravity/inventory).

How resources get into inventory

Two independent paths populate inventory:

• Cloud discovery. Once you connect a cloud provider account, Sencai runs a read-only scan of that account and records what it finds - instances, networks, storage, and more, depending on the provider. This is how resources you didn’t provision through Sencai (existing infrastructure) show up.
• Fleet agent reporting. Servers running the fleet agent report their own software inventory independently of cloud discovery - see the Software view below.

What a managed resource record holds

Each discovered resource carries:

• Identity - provider, region, resource type, and the provider’s own external ID
• Tags, as set at the provider
• An ownership state (see below)
• Raw metadata as returned by the provider, plus any related-resource references Sencai can extract from it (for example a VPC or subnet ID)

Click into any resource (/gravity/inventory/<id>) for its full detail: identity and metadata, current tags, ownership state, and - where applicable - a link to the managed instance, network, or storage record it’s been promoted to (see below).

Ownership states

Every discovered resource has one of four ownership states:

State	Meaning
Unmanaged	Discovered, but not yet reviewed or claimed - the default for a freshly scanned resource
Managed	Adopted as fully managed by Sencai - write actions (tagging, lifecycle changes) are available
Read-only	Adopted for tracking and compliance visibility only - write actions are disabled, since Sencai isn’t meant to change this resource
Ignored	Marked as intentionally out of scope, so it stops showing up as an open item

You set ownership individually or in bulk (select multiple rows, then Adopt) from the inventory list.

Promoting a discovered resource to a managed one

A discovered instance, network, or storage volume that’s eligible can be promoted - turned into a first-class managed record with its own detail page and full write access (start, stop, resize, and the rest), rather than staying a read-only inventory entry. This is the mechanism behind importing existing infrastructure: discovery finds it, promotion brings it fully under Sencai’s management. Not every discovered resource type is eligible for promotion yet - storage volume promotion in particular is limited today, since there’s no dedicated managed-storage detail screen for every provider.

Tag governance and required tags

Tag compliance is enforced through the same policy engine that checks everything else - there’s no separate tag-policy configuration screen. A policy that checks for the presence of a tag key (an “exists” condition against a tags.<key> field) effectively makes that key a required tag for whatever provider/resource-type scope the policy covers. Resources missing a tag a policy expects show up as violations, the same way any other policy finding does.

The Tags view (reachable from the badge next to the inventory list, /gravity/inventory/tags) collects exactly these tag-compliance violations in one place, so you don’t have to hunt for them in the general findings list:

1. Review the list of resources with missing required tags.
2. Select one, several, or use Fix all for every violation shown.
3. Enter the missing tag key/value pairs and submit - tags are written back to the resource at the provider asynchronously; the result appears once the write completes.
4. Use Confirm on a violation you’ve reviewed and don’t want flagged again for now, without necessarily fixing the tag immediately.

Drift detection

Drift (/gravity/inventory/drift) is Sencai’s record of changes made to your managed or adopted resources outside of Sencai - someone editing a security group directly in the provider console, for example. Each drift event has a severity (low, medium, high) and a before/after comparison.

To act on a drift event:

• Acknowledge it once you’ve reviewed the change and decided it’s expected or acceptable.
• If it isn’t expected, use it as your signal to investigate and correct the resource - Sencai records the drift, it doesn’t automatically revert it.

Tag-compliance violations are themselves a specific category of drift event under the hood, which is why the Tags view and the general Drift view share the same underlying mechanism.

Software inventory

Software (/gravity/inventory/software) is a different kind of inventory - installed package data reported by the fleet agent from your enrolled servers, not discovered from a cloud provider. Search across every host in your organization by package name; each result shows the host, OS, package name and version, source, and an end-of-life status flag where Sencai has that data, so you can spot packages that are approaching or past end of support across your whole fleet from one screen.

Export

The inventory list exports CSV or JSON, and the NIS2 evidence timeline exports CSV or PDF - in each case for the currently filtered view, using the export buttons on each screen. For a broader, BI-oriented data export across audit, cost, and instance data together, see Data export.

What’s next

• Cloud → Importing - the full flow for bringing existing infrastructure under management
• Policies - where tag requirements and other guardrails are defined
• Costs → Allocation - cost showback and chargeback, which reads tags from this same inventory
• Fleet - enrolling the agent that reports software inventory