Move Cloud Security ownership docs under Review and Remediate by lucasdmaley · Pull Request #38654 · DataDog/documentation

lucasdmaley · 2026-07-31T18:33:28Z

What does this PR do? What is the motivation?

Moves the Ownership Agent and Set Up Ownership Preferences pages from the Frontier Group guide into the Review and Remediate section of Cloud Security.

Moves both pages to content/en/security/cloud_security_management/review_remediate/.
Adds aliases so the old guide/frontier_group/... URLs redirect to the new locations.
Updates the left-nav menu, cross-links between the two pages, the Frontier Group index links, and a reference on the Runtime Prioritization Engine page.
Adds an "Automatic team assignment" section to the Ownership Agent page describing the default team tag behavior and the ownership settings page.

Merge instructions

Merge readiness:

Ready for merge

Additional notes

No Jira ticket was provided, so the title omits a [DOCS-XXXXX] key. Let me know the ticket and I can update the title and description.

Made with Cursor

Move the Ownership Agent and Set Up Ownership Preferences pages from the Frontier Group guide into the Review and Remediate section, add aliases so the old URLs redirect, update internal links and the left-nav menu, and add an Automatic team assignment section describing the ownership settings. Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

github-actions · 2026-07-31T18:43:24Z

Preview links (active after the `build_preview` check completes)

Renamed files

Modified Files

Co-authored-by: Cursor <cursoragent@cursor.com>

OliviaShoup

Thanks for the PR! It looks great.

Just two things to resolve, plus some line edits inline.

1. The pages now contradict the Frontier Group page on availability. Details inline on guide/frontier_group/_index.md. This is the one I'd want settled before merge, since the answer changes what the pages should say.

2. The parent landing page wasn't updated. review_remediate/_index.md has a whatsnext block listing every child page, and the two new pages aren't in it, so the Review and Remediate landing page is now missing two of its five children. The existing entries use descriptive phrasing rather than bare titles, so something like:

    {{< nextlink href="/security/cloud_security_management/review_remediate/ownership_agent" >}}Infer resource owners with the Ownership Agent{{< /nextlink >}}
    {{< nextlink href="/security/cloud_security_management/review_remediate/ownership_preferences" >}}Set up ownership preferences with your own data{{< /nextlink >}}

Pre-existing nits on the Ownership Agent page. Normally I'd leave these alone, but this PR promotes the page from a guide into the main product nav, which is a real jump in visibility. These fall outside the diff so I couldn't attach them inline:

Line 69: including specifying incorrectness of incompletness of the explanation — incompletness is misspelled, and the second of should be or.
Line 56: double space after Vulnerabilities Explorer,. This is the only Vale error in the PR.
Line 99: malformed formatting — @_dd.ownership.inference.explanation:*tag has a stray asterisk outside the closing backtick.

On ownership_preferences.md, Vale flags first-person pronouns at lines 174, 303, and 305 (our, us) and sentence-case heading issues at 313 and 329. All pre-existing and lower priority.

OliviaShoup · 2026-07-31T19:36:05Z

@@ -23,8 +23,8 @@ The frontier group is an opt-in program where you get access to the newest AI fe
 ***Status:*** *available for frontier partners*<br>


This status line is the crux of my main concern with the PR.

This page still says the Ownership agent is "available for frontier partners," but this PR moves both ownership pages into the main Review and Remediate nav, beside GA features like Mute Issues and Automate Security Workflows. Neither page carries a Preview, Limited Availability, or frontier-partner callout, so a reader arriving through the left nav has no way to know the feature is gated.

The new "Automatic team assignment" section pushes further toward a GA reading ("By default, high-confidence ownership inferences are applied to the team tag").

Two coherent outcomes:

If the feature is now GA: update or remove this Frontier Group entry, since it advertises as frontier-exclusive something generally available.

If it is still frontier-only: add an availability callout to both ownership pages, and reconsider whether they belong in the main nav yet.

As it stands the two pages disagree with each other. Could you confirm which is accurate?

It's now GA! Updated the Frontier Group entry

OliviaShoup · 2026-07-31T19:36:05Z

-| `image` (container)              | Docker, ECR, and other registries |
+| Cloud provider                    | Resource types |
+| --------------------------------- | -------------- |
+| AWS                               | `aws_cloudformation_stack`, `aws_cloudfront_distribution`, `aws_cognito_user_pool`, `aws_dynamodb`, `aws_ec2_instance`, `aws_ec2_settings`, `aws_ecr_repository`, `aws_ecs_cluster`, `aws_ecs_service`, `aws_elbv2_load_balancer`, `aws_iam_account`, `aws_iam_policy`, `aws_iam_role`, `aws_iam_role_inline_policy`, `aws_iam_user`, `aws_lambda_function`, `aws_rds_cluster`, `aws_rds_instance`, `aws_s3_bucket`, `aws_secretsmanager_secret`, `aws_security_group`, `aws_subnet`, `aws_vpc` |


Flipping the columns was the right call. One row per resource type would have been unusable at 27 entries. But the AWS cell is now 23 comma-separated code spans against rows holding one or two, so it wraps into a dense block that's hard to scan when looking for a specific type.

Worth considering a definition-style list instead of a table:

AWS: aws_cloudformation_stack, aws_cloudfront_distribution, ...

Azure: azure_virtual_machine_instance

Separately, the Cloud provider column header doesn't fit the last row — "Docker, ECR, and other registries" aren't cloud providers. Source or Provider would cover both cases.

(The list is correctly alphabetized, which helps.)

OliviaShoup · 2026-07-31T19:36:05Z

@@ -80,6 +80,12 @@ You can provide richer feedback by clicking the "thumbs down" after hovering ove

 Corrections and feedback are vital for tuning the agent to correctly infer ownership in future, and affect how the Ownership Agent behaves for that resource going forward.


Pre-existing, but the line is in this diff's context so it's easy to fix here: "in future" should be "in the future".

Suggested change

Corrections and feedback are vital for tuning the agent to correctly infer ownership in future, and affect how the Ownership Agent behaves for that resource going forward.

Corrections and feedback are vital for tuning the agent to correctly infer ownership in the future, and affect how the Ownership Agent behaves for that resource going forward.

Vale also flags this sentence for length (26 words). If you want to split it: "Corrections and feedback are vital for tuning the agent. They also affect how the Ownership Agent behaves for that resource going forward." That drops some redundancy between "infer ownership in the future" and "going forward".

OliviaShoup · 2026-07-31T19:36:05Z


+## Automatic team assignment
+
+By default, high-confidence ownership inferences are applied to the `team` tag on Cloud Security findings. This makes inferred owners available in platform features, through the MCP server, and in automatic notification routing.


Three things in the second sentence:

The series mixes prepositions (in / through / in), which breaks parallel structure.

"platform features" is vague — which features?

"the MCP server" is unspecific and unlinked. Presumably the Datadog MCP server?

Suggested change

By default, high-confidence ownership inferences are applied to the `team` tag on Cloud Security findings. This makes inferred owners available in platform features, through the MCP server, and in automatic notification routing.

By default, high-confidence ownership inferences are applied to the `team` tag on Cloud Security findings. Inferred owners then become available in other Datadog features, including the Datadog MCP server and automatic notification routing.

Please confirm the MCP server reference and add a link if there's a docs page for it — I didn't want to guess the URL.

OliviaShoup · 2026-07-31T19:36:05Z

+
+By default, high-confidence ownership inferences are applied to the `team` tag on Cloud Security findings. This makes inferred owners available in platform features, through the MCP server, and in automatic notification routing.
+
+To adjust the confidence threshold, or to turn off automatic team assignment entirely, use the [ownership settings page](https://app.datadoghq.com/security/configuration/csm/ownership-agent).


The comma incorrectly splits a compound infinitive ("To adjust... or turn off..."), and "entirely" isn't doing any work.

Suggested change

To adjust the confidence threshold, or to turn off automatic team assignment entirely, use the [ownership settings page](https://app.datadoghq.com/security/configuration/csm/ownership-agent).

To adjust the confidence threshold or turn off automatic team assignment, use the [ownership settings page](https://app.datadoghq.com/security/configuration/csm/ownership-agent).

Separately, a content gap: this section tells readers they can adjust the confidence threshold but never says what the default is, or what "high-confidence" means numerically. The facets table further down establishes that confidence runs 0 to 1, so stating the default value here would let readers decide whether they need to change anything at all.

Mark the Ownership Agent as generally available on the Frontier Group page, add both ownership pages to the Review and Remediate landing page, convert the supported resource types table to a provider list, and apply copy and Vale fixes across both ownership pages. Co-authored-by: Cursor <cursoragent@cursor.com>

OliviaShoup

Thank you for the quick turnaround!

Only a couple things still open:

The default confidence threshold value is still unstated (inline on line 88). This was the second half of my earlier comment.
The new status line wording on the Frontier Group page (inline), plus a scoping question about whether a GA feature should still be listed there at all.
AWS resource-type density is only partially addressed (inline).

Both blockers from my original review are resolved, so moving this from Changes Requested to a comment.

OliviaShoup · 2026-07-31T20:01:08Z

- "The cost-center tag is our most reliable ownership signal for all cloud resources."
+- "The cost-center tag is the most reliable ownership signal for all cloud resources."
 - "Team identifiers always use the team- prefix (for example, team-platform, team-data-eng)."
 - "Resources in the us-east-1/prod account are managed by team-sre."


Retracting an earlier comment of mine — no change needed here, and thanks for correctly leaving it alone.

I flagged us on this line as a first-person pronoun based on a Vale warning. It's actually the AWS region us-east-1; Vale substring-matched inside it. Noting it explicitly so this doesn't get "fixed" later and break the region name.

OliviaShoup · 2026-07-31T20:01:08Z

 ### Ownership agent

-***Status:*** *available for frontier partners*<br>
+***Status:*** *generally available, 6 months after it was first tested by frontier partners*<br>


Thanks for confirming GA — that resolves the contradiction I raised. Three things about the new wording though:

It breaks this page's convention. Every other entry is a short phrase: available for frontier partners (x3) and coming soon (x2). This one is a 12-word sentence carrying history.

It ages badly. "6 months after it was first tested" stops being true in six months. The style guide specifically warns against temporal phrasing for this reason.

The status itself is the useful part.

(Suggestion below is Claude-authored.)

Suggested change

***Status:*** *generally available, 6 months after it was first tested by frontier partners*<br>

***Status:*** *generally available*<br>

Separate scoping question, your call: now that the Ownership Agent is GA, does it belong on a page describing an opt-in program for the newest AI features? Removing the entry, or moving it to a "graduated" list, may be cleaner than restating GA here. That's a content decision rather than a style one.

OliviaShoup · 2026-07-31T20:01:08Z

+
+By default, high-confidence ownership inferences are applied to the `team` tag on Cloud Security findings. Inferred owners then become available in other Datadog features, including the [Datadog MCP server](/mcp_server/) and automatic notification routing.
+
+To adjust the confidence threshold or turn off automatic team assignment, use the [ownership settings page](https://app.datadoghq.com/security/configuration/csm/ownership-agent).


The comma and "entirely" fixes look good.

One question from my original comment: this tells readers they can adjust the confidence threshold, and line 86 says high-confidence inferences are applied by default, but the default threshold value is never stated. A reader can't tell whether they need to change it or leave it alone. Could you add the default (or say where it's shown in the UI)?

The default threshold value is "high", other values are "medium" and "low"

OliviaShoup · 2026-07-31T20:01:08Z

-The Ownership Agent processes the following cloud resource types:
+The Ownership Agent processes the following resource types:

+**AWS**: `aws_cloudformation_stack`, `aws_cloudfront_distribution`, `aws_cognito_user_pool`, `aws_dynamodb`, `aws_ec2_instance`, `aws_ec2_settings`, `aws_ecr_repository`, `aws_ecs_cluster`, `aws_ecs_service`, `aws_elbv2_load_balancer`, `aws_iam_account`, `aws_iam_policy`, `aws_iam_role`, `aws_iam_role_inline_policy`, `aws_iam_user`, `aws_lambda_function`, `aws_rds_cluster`, `aws_rds_instance`, `aws_s3_bucket`, `aws_secretsmanager_secret`, `aws_security_group`, `aws_subnet`, `aws_vpc`


Moving to definition style was the right direction. Two follow-ups:

My underlying concern was density: the AWS entry is still a single run of 23 comma-separated code spans, which is hard to scan when hunting for one specific type. That's unchanged, just relocated out of the table cell.

These are standalone bold paragraphs rather than list items. The definition-style convention uses list items, and a bulleted list also scans better and chunks more cleanly for AI retrieval. Prefixing each line with - would do it.

Also minor: there's a double blank line above the ## Supported resource types heading and again after the Container registries line.

…/ownership_preferences.md Co-authored-by: Olivia Shoup <116908616+OliviaShoup@users.noreply.github.com>

lucasdmaley requested a review from a team as a code owner July 31, 2026 18:33

github-actions Bot added the Architecture Everything related to the Doc backend label Jul 31, 2026

Expand supported resource types table for Ownership Agent

ec7573c

Co-authored-by: Cursor <cursoragent@cursor.com>

Restructure supported resource types table by cloud provider

617ab16

Co-authored-by: Cursor <cursoragent@cursor.com>

OliviaShoup requested changes Jul 31, 2026

View reviewed changes

lucasdmaley requested a review from OliviaShoup July 31, 2026 19:52

OliviaShoup reviewed Jul 31, 2026

View reviewed changes

lucasdmaley and others added 2 commits July 31, 2026 16:22

Update content/en/security/cloud_security_management/review_remediate…

8b3e280

…/ownership_preferences.md Co-authored-by: Olivia Shoup <116908616+OliviaShoup@users.noreply.github.com>

Update content/en/security/cloud_security_management/review_remediate…

b66cfdd

…/ownership_preferences.md Co-authored-by: Olivia Shoup <116908616+OliviaShoup@users.noreply.github.com>

		@@ -23,8 +23,8 @@ The frontier group is an opt-in program where you get access to the newest AI fe
		*Status:* available for frontier partners<br>

		@@ -80,6 +80,12 @@ You can provide richer feedback by clicking the "thumbs down" after hovering ove

		Corrections and feedback are vital for tuning the agent to correctly infer ownership in future, and affect how the Ownership Agent behaves for that resource going forward.


		## Automatic team assignment

		By default, high-confidence ownership inferences are applied to the `team` tag on Cloud Security findings. This makes inferred owners available in platform features, through the MCP server, and in automatic notification routing.


		By default, high-confidence ownership inferences are applied to the `team` tag on Cloud Security findings. This makes inferred owners available in platform features, through the MCP server, and in automatic notification routing.

		To adjust the confidence threshold, or to turn off automatic team assignment entirely, use the [ownership settings page](https://app.datadoghq.com/security/configuration/csm/ownership-agent).

	To adjust the confidence threshold, or to turn off automatic team assignment entirely, use the [ownership settings page](https://app.datadoghq.com/security/configuration/csm/ownership-agent).
	To adjust the confidence threshold or turn off automatic team assignment, use the [ownership settings page](https://app.datadoghq.com/security/configuration/csm/ownership-agent).

	*Status:* generally available, 6 months after it was first tested by frontier partners<br>
	*Status:* generally available<br>

Uh oh!

Conversation

lucasdmaley commented Jul 31, 2026

What does this PR do? What is the motivation?

Merge instructions

Additional notes

Uh oh!

github-actions Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Preview links (active after the build_preview check completes)

Renamed files

Modified Files

Uh oh!

OliviaShoup left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

OliviaShoup left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Jul 31, 2026 •

edited

Loading

Preview links (active after the `build_preview` check completes)