Skip to main content
Scope. This page covers the model-assisted explanations of posture findings produced by the optional Edge collector’s scanners. ChangeGuard’s judgment (SHIP / HOLD / BLOCK) is deterministic and runs in the control plane, and the Engineering Advisor reasoning layers (Early Access) run on Amazon Bedrock in the control plane. Neither is affected by the settings below. Self-hosted inference for judgment and reasoning is roadmap — see Known limitations and roadmap.
ChangeGuard AI includes model-assisted analysis of your cluster’s security posture — the backend owns the facts and the numbers; the model writes the language. By default this runs server-side on Amazon Bedrock using Anthropic’s Claude — there is nothing to install and no GPU required. For the Edge collector’s on-cluster scan analysis, you can optionally route that inference through NVIDIA NIM instead (an Edge chart setting, off by default).

​
Inference backends

​
What AI Analyzes

  • Risk explanations — why a CVE or finding matters
  • Remediation guidance — specific commands to fix issues
  • Compliance mapping — which controls a finding affects
  • Attack path narrative — privilege escalation chains in plain English

​
Configuration

AI analysis works out of the box on Amazon Bedrock — no configuration required. Add an ai block to your ChangeGuardAgent resource only if you want to route inference through NVIDIA NIM instead.
See NVIDIA NIM Integration for detailed setup.