How we detect AI usage
We read the traces AI leaves behind. Not what people type.
Every agent that does real work has to touch your company's systems — and those systems already keep a log of who did what, from where, and how fast. Sonsara connects read-only, recognises the patterns that only software makes, and turns them into a shortlist of agents worth making official.
In one picture
Every AI action leaves a line in a log. We read them all.
AI tools reach into your company's systems all day. Every request lands in an audit log. Sonsara scans the stream, spots the work that repeats, and proposes the agents worth making official.
01AI tools
02Company tools
03One audit stream
metadata only0 lines / sec
04Sonsara finds the work
The pipeline
Connect, read, recognise, propose.
Four steps from "we think people are using AI" to a list of the agents your company should own.
01 · Connect
Plug into the tools you already run
Read-only access to your identity provider and the audit logs of your work tools. One app consent or admin key per system. Nothing installed on anyone's laptop.
- Entra ID · Google Workspace · Okta
- Microsoft 365 · Atlassian · Slack
- GitHub · GitLab · meeting platforms
02 · Read
Read the logs, not the work
We take the metadata those systems already record — which system, which client, which app, when and how often — and leave the content where it is.
- client type · user agent · app id
- timing · volume · sequence
- consents · tokens · connected apps
03 · Recognise
Pattern-match the workflows
Agents work at machine speed and regularity; people don't. Signals from every system are joined into one timeline per person, then grouped into recurring jobs.
- machine-paced access
- AI app consents · programmatic clients
- repeated sequences across systems
04 · Propose
Shortlist the agents worth keeping
Findings become a ranked backlog of candidate company agents — by job, systems touched and team. A short interview with the person confirms each one before we build it.
- ranked by usage and risk
- connectors it will need
- owner to interview
The tell
People and agents move at different speeds.
An agent reads a whole Jira project in seconds, at even intervals, at 6am. A person opens three tickets between meetings. The difference shows up in the metadata — no content required.
A person, in the browsersso session · irregular · pauses
An agent, same accountapi token · node-fetch · bursts
What we look for
Eight signals an agent can't help leaving.
None of them proves much on its own. Together, and checked against your list of approved tools, they do.
SaaS audit logs
Machine pace
Bursts of dozens of requests a minute, at even intervals, reading a whole space or project in order.
SaaS audit logs
Programmatic clients
Requests from python-requests, node-fetch or an MCP server where that person only ever used a browser.
SaaS audit logs
Tokens instead of sign-in
Access through a new API token or personal access token rather than the usual single sign-on session.
Identity provider
Consents to AI apps
Someone connects ChatGPT, Claude or Gemini to their mail, drive, wiki or code — recorded wherever the agent runs.
SaaS audit logs
No human rhythm
Steady activity at unusual hours, with none of the pauses a person takes between tasks.
Sign-in logs
Cloud agent addresses
Requests from AI vendors' cloud ranges, or from home networks, to systems normally reached from the office.
Code repositories
Fingerprints in the code
Agent instruction files like AGENTS.md, "Co-Authored-By" trailers, and branches named by cloud agents.
Meeting & mail logs
Note-takers and mail rules
AI note-taker bots joining calls, forwarding rules to outside addresses, mailboxes read by unknown clients.
From pattern to workflow
A finding is a job someone already does with AI.
Signals from different systems join up into a workflow: what triggers it, what it reads, what it sends, how often. That's most of a spec for a company agent. The interview with the person fills in the rest — and they get a better, supported version of the thing they built themselves.
Finding · F-0142
finance · user 7f3a·c1 (pseudonymised) · example data
Signals
- Entraconsent → ChatGPT connector (Outlook)
- Xeronode client · weekdays 08:55–09:05 · 38/wk
- Outlooksend → ap@ within 2 min of each run
- RegistryChatGPT personal · not approved
Inferred workflow
09:00 weekdays→read Xero invoices→compare→email AP
Proposed
Supplier reconciliation agentConnectors: Xero · OutlookNext: interview owner
Coverage
Wherever the agent runs, it shows up where it works.
Laptop, phone or someone else's cloud: an agent that's useful at work eventually touches your systems, and those systems keep the record.
Company laptop
Coding and desktop agents
Claude Code, Cursor, Copilot agents — visible when they reach your tools.
Personal device
Agents with a work token
Invisible to device tools; visible in the audit logs of every system they touch.
Vendor cloud
Cloud and background agents
Run on the AI vendor's servers, show up through consents and vendor addresses.
Chat with connectors
ChatGPT, Claude, Gemini
Connected to mail, drive or wiki through an OAuth consent your identity provider records.
The honest limit: an agent that never touches your company's systems leaves nothing in their logs. If you want to see those too, there are deeper layers below — each one optional, and only once you've seen what the first one finds.
Start heredays
Tool connectors
Read-only access to your identity provider and work tools. No install. This is where every pilot begins.
Optional1–2 weeks
Declaration
A short survey with an amnesty: people tell you which agents they use and for what. The fastest source of use cases.
Optional1–2 weeks
Existing logs
DNS, web gateway, SIEM and expense exports you already collect — filtered on your side to AI domains only.
Optional2–4 weeks
Device check
A small, signed check your IT deploys through its own device management: is an agent installed, and is it signed in to a company or personal account?
Privacy
Discovery, not surveillance.
We answer "is an unapproved agent working here, and which systems does it touch?" — never "what is this person doing or writing?"
- Which of your systems an agent touches, and how often
- Client type, app id, timing and volume of requests
- Consents to AI apps and the creation of new tokens
- People as pseudonyms — re-identification is an audited action by your admins
- Prompts, model responses or agent session history
- The contents of files, pages, tickets or messages
- Tokens, keys or email addresses from anyone's setup
- Browsing history beyond visits to known AI services
We won't
Plant traps for agents
No hidden "if you're an AI, do this" text in your documents. It manipulates someone else's software and can trigger actions nobody wanted.
We won't
Decrypt traffic to read prompts
It would give the most precise picture — by collecting exactly what we promise not to.
We won't
Take screenshots or histories
Disproportionate, and unnecessary: the metadata is enough to find the work.
A finding leads to an offer — a better, supported agent for the job — not a sanction. Discovery works best when declaring an agent is easier than hiding it.
Book a demo
See the AI work already happening in your company.
Read-only access, nothing to install, first findings in days.