# Agreements Overview Source: https://docs.brm.ai/agreements-overview The vendor knows your contract better than you do. They wrote it that way. Well, not anymore. ## **Quick Start: How to Access the Agreements Overview** **Getting there is simple:** 1. **Log in to BRM** 2. **Go to Agreements** in the main navigation 3. **Click any agreement** to open the Agreements Overview That's it. The Agreements Overview is now the default view when you open any agreement. **You can also access it from:** * **AI Chat**: Click any agreement link in an Ask BRM response * **Pre-verification access** (if enabled for your organization) ## **What You'll See: The 6 Key Features** ### **1. Dynamic Header: Facts First, Tailored to Agreement Type** BRM detects what kind of agreement you're looking at—SaaS, services, lease, hardware—and immediately surfaces the high-value facts: **annualized cost, total cost, commercial model, term, and next action**. No blank fields. No irrelevant sections. Just what matters for this agreement. The person who asks "How much do we pay?" gets their answer in 10 seconds instead of 20 minutes. Nodex Agreement ### **2. Line-Item Extraction: See What You Actually Bought** Modules, SKUs, add-ons, implementation fees—all pulled out and organized into a comparable table, and mapped to a real product or service. See exactly what you bought and what you're paying for each piece. This is what makes line-item negotiation possible. **Real examples from customers:** * Three overlapping project management tools nobody had noticed * "Platform fees" they'd forgotten they were paying * Implementation fees that were supposed to be one-time but were recurring monthly Quatrix Agreement ### **3. Multi-Tool Visibility: Know the Products, Not Just the Vendors** That "HubSpot" agreement? It might include Sales Hub, Marketing Hub, and CRM—three different products with three different use cases and three different costs. **One contract. Six distinct products. Zero visibility—until now.** BRM identifies the actual tools inside each agreement, revealing overlaps and long-tail spend hiding in plain sight. Stop managing vendors. Start managing your stack. Multi Tool Line Items ### **4. Finance-First Classification** Every agreement gets typed with a taxonomy built for portfolio analysis: **subscription, usage/metered, one-time, services, hardware/lease**. Now your comparisons are apples-to-apples across vendors and categories. Know what you're spending on SaaS vs. services vs. hardware at a glance. ### **5. Ask BRM: AI That Actually Knows Your Contracts** Ask plain-English questions directly on the agreement page: * "How much would we pay for 15 more seats?" * "Do we have other tools that do this?" * "What happens if we cancel early?" * "Can we terminate before the end date?" Get answers grounded in the actual contract, with citations to the source. No hallucinations. No guessing. Chat ### **6. Full Auditability** Access all source documents, see cost breakdowns including annualized totals, and view verification history. When someone asks, "Where did this number come from?"—you have the answer. Every field links back to the source. Every calculation is transparent. ## **Why This Changes How You Work** **The old way:** Someone asks, "How much do we pay Salesforce?" and you spend 20 minutes hunting through a PDF, checking amendments, doing math, and still not being 100% confident in your answer. **The new way:** Open the agreement. The answer is right there—annualized, verified, current. The Agreements Overview moves your team from reactive verification to proactive decisioning: * **Negotiate at the line-item level**, not just the total * **Catch renewals before they auto-trigger** * **See your full stack clearly**, even when one vendor sells you five products * **Make faster, more confident portfolio decisions** * **Walk into meetings with answers**, not follow-up promises * **Get 10+ hours per month back**—time returned to strategic work instead of PDF archaeology ## **Why This Exists Now (And Didn't Before)** ### **Your contracts shouldn't be dead data** Your contracts contain some of the most important data about your business—what you're committed to, what you're paying, and when you need to act. But as PDFs are scattered across email and drives, that data is effectively dead. You can't query it. You can't act on it. You can't even find it when you need it most. Most contract tools digitize PDFs and hope humans can make sense of them. The problem was never storage. It was structure. Contracts are written in natural language—bespoke terms, nested amendments, vendor-specific quirks. Making them queryable and comparable at scale required something that didn't exist until recently: **AI that can reason over unstructured text, grounded in a structured understanding of what it's reading.** ### **What we built** We've been building what informed decision-makers need - not just a contract viewer, but a unified data model—an ontology that understands what a vendor is, what an agreement is, what a line-item is, and how they all relate. This foundation is what lets us: * Extract line-items automatically * Detect agreement types * Map multiple tools to a single vendor * Give you answers grounded in actual contract language * Keep everything current as amendments roll in We started this work in 2022, before "context engineering" was a term, before the industry recognized that ontology is the unlock for AI that actually works. We were early because we believed it was the only path to something that could genuinely help people buy. **The Agreements Overview is the most visible proof of that investment.** It's not a feature bolted onto a legacy system—it's what happens when you build AI-native from the ground up. ## **The Bigger Picture: Where This Is Going** We started BRM with a belief: **the keystone of B2B is company identity.** If you can build a unified understanding of who companies are, what they sell, and how they relate to each other, you can finally make sense of the fragmented systems that make buying so painful. Agreements are where this thesis meets reality. Every contract is a record of a relationship—vendor, terms, products, obligations. But until now, that information has been trapped in PDFs, scattered across inboxes,and impossible to query at scale. ## **Most teams are still digging through PDFs** Yours doesn't have to be. The vendor will always know their side of the deal. Now you can finally know yours. ## **Need Help?** If you have questions about the Agreements Overview or need assistance getting started, reach out to our support team and we will be happy to help. # Anthropic AI Usage Integration Source: https://docs.brm.ai/anthropic-ai-usage This article walks you through connecting your Anthropic (Claude) account to BRM so we can show your team's token usage, model usage, and cost data. ***Why this matters:***\_ Claude spend is often one of the largest line items in an AI bill, and one of the hardest to break down by model or team without this connection.\_ ⚠️ **Important:** BRM needs a Claude Console **Admin API key**, rather than a regular Claude API key. A normal key will not work, even though it may look valid. *Note: Admin keys usually start with "sk-ant-admin01-...."* BRM uses this key only to read organization-level usage and cost reports. BRM never uses it to send prompts to Claude or to access your conversations. Before you start, confirm you're using **Claude Console** (not Claude Enterprise — see the note at the bottom of this page). ## What you'll need | **Credential** | Claude Console Admin API key (starts with sk-ant-admin01-...) | | :- | :- | | **Who can create it** | An organization admin in Claude Console | | **Where it's created** | Claude Console → Organization Settings → Admin keys | ## Step 1: Sign in to Claude Console Sign in to your [Claude Console](https://platform.claude.com/) using an account that has **organization admin** permissions. If you're not an admin, you won't be able to see the Admin keys page — ask an admin on your team to complete these steps instead. ## Step 2: Go to Admin keys In the left-hand navigation, go to **Organization Settings → [Admin keys](https://platform.claude.com/settings/admin-keys)**. ## Step 3: Create a new key Click **Create key**. ## Step 4: Name the key Tip: Name the key "BRM AI Usage" so it's easy to find and manage later. ## Step 5: Copy the key Copy the key right away, as Claude Console only shows it once. Paste it directly into BRM's integration setup screen. Don't paste it into email, Slack, or any other chat tool. ## Step 6: Enter the key in BRM In BRM, navigate to your account settings by clicking on your profile in the lower left-hand corner of the screen, then click on "Integrations." Navigate to the Anthropic integration, click "Connect," and paste in the key. BRM will confirm the connection and begin pulling in usage data. Screenshot 2026 07 07 At 11 01 25 AM ## Common mistakes * **Using a regular Claude API key instead of an Admin key.** Regular keys (from Workspace API keys) will not work for this integration. * **Signing in as a non-admin.** If you can't find Admin keys in Settings, you don't have org admin permissions — ask your Claude Console admin. * **Using Claude Enterprise instead of Claude Console.** These are different products with different admin tools. If your organization only has Claude Enterprise, contact BRM support before continuing. ## Provider documentation Our steps above should stay current, but if Anthropic changes their interface, these are the source-of-truth docs: * [Create an Admin API key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys) * [Usage and Cost API](https://platform.claude.com/docs/en/manage-claude/usage-cost-api) * [Admin API overview](https://docs.anthropic.com/en/api/administration-api) ## Still stuck? Reach out to BRM support and let us know which step you're stuck on. Don't send your API key over email or chat — we'll point you to a secure way to share it if needed. \\ # AWS Integration Source: https://docs.brm.ai/aws-integration This article walks you through connecting your AWS account — or your entire AWS Organization — to BRM so we can show your AWS Marketplace agreements and spend, AWS service costs, and Amazon Bedrock AI usage. ***Why this matters:*** *software bought through AWS Marketplace — including large, privately negotiated contracts — often never reaches your procurement or finance systems, so renewal dates and payment schedules stay invisible. Bedrock AI spend similarly hides inside a much larger cloud bill.* ⚠️ **Important:** Unlike most integrations, this one uses **no API keys or passwords at all**. You launch a CloudFormation stack that creates a **read-only IAM role** in your account, and BRM connects to that role through identity federation. There is no credential to copy, store, or rotate — and you can cut off access at any time by deleting the role. ## Choose your setup type The BRM connect dialog asks which setup you have. Pick based on how your AWS is structured: | **Single AWS account** | You run everything in one AWS account (or only want to connect one). | | :- | :- | | **AWS Organization** | You use AWS Organizations with a management account and member accounts. Connect the **management account** — its billing data covers every account in the organization — and optionally cover member accounts with a StackSet. | If you're not sure, check whether your AWS bill is consolidated: if multiple accounts roll up into one bill, you have an AWS Organization, and the account that owns that bill is the management account. ## What you'll need | **Credential** | None — a CloudFormation stack creates a read-only IAM role | | :- | :- | | **Who can do this** | An AWS console admin in the account you're connecting (for an AWS Organization: an admin in the **management account**) | | **Also needed** | Cost Explorer enabled, and "IAM user and role access to billing information" activated (see Before you connect) | ## Before you connect Two account-level settings must be on in the account you're connecting (for an AWS Organization, the management account). Both are one-time toggles: 1. **Enable Cost Explorer.** In the AWS console, open **Cost Explorer** from the Billing console. If it has never been opened, AWS takes up to 24 hours to prepare your data — do this first. 2. **Activate IAM access to billing information.** In **Account settings** (in the Billing console), enable **IAM user and role access to billing information**. Without this, no IAM role — including BRM's — can read billing data, regardless of its permissions. ## Connect a single AWS account ### Step 1: Open the AWS integration in BRM In BRM, click your profile in the lower-left corner, then **Integrations**. Find **AWS** and click **Connect**. Leave the setup type on **Single AWS account**. ### Step 2: Launch the CloudFormation stack Sign in to the AWS console for the account you want to connect (an admin who can create IAM roles), then click **Launch CloudFormation stack in the AWS console** in the BRM dialog. The stack opens with everything pre-filled — you don't need to change any parameters. Check the acknowledgment box ("I acknowledge that AWS CloudFormation might create IAM resources with custom names") and click **Create stack**. ### Step 3: Copy the role ARN When the stack finishes (usually under a minute), open its **Outputs** tab and copy the **RoleArn** value. It looks like `arn:aws:iam::123456789012:role/BRMIntegrationRole`. ### Step 4: Paste the ARN into BRM Back in the BRM dialog, paste the role ARN and click **Create Integration**. BRM verifies it can assume the role and confirms the connection. ## Connect an AWS Organization ### Step 1: Choose organization mode In the BRM connect dialog, switch the setup type to **AWS Organization (multiple accounts)**. ### Step 2: Launch the stack in your management account Follow the same stack launch as a single account, but sign in to your **management account** — the account that owns your consolidated bill. This matters: BRM verifies at connect time that the role really is in the management account, and will tell you if it isn't. Copy the **RoleArn** from the stack's Outputs tab, paste it into BRM, and click **Create Integration**. The management account's billing data covers spend for **every account in your organization**, so this single connection is already complete for cost tracking. ### Step 3 (optional): Cover member accounts with a StackSet Some data only exists inside each member account — most importantly, AWS Marketplace agreements purchased from that account. To cover them, create a **CloudFormation StackSet** from the management account. It deploys the same read-only role to every member account, and automatically to new accounts as they join your organization. The BRM dialog shows the exact commands with your values pre-filled. You can run them now or any time later — spend tracking works either way. ℹ️ If any account already has the `BRMIntegrationRole` from an earlier standalone stack, exclude it from the StackSet targets (or delete its standalone stack first) — otherwise the deployment to that account fails because the role name already exists. ## What BRM reads The role is strictly read-only and scoped to procurement and cost data: * AWS Marketplace agreements (including private offers), their terms, and contract documents * Cost and spend data from Cost Explorer, including committed spend such as Savings Plans and Reserved Instances * Amazon Bedrock usage and per-model spend * Invoices, budgets, and organization account names BRM cannot create, modify, or delete anything in your AWS account, cannot read your workloads or data, and cannot see anything outside these billing and procurement APIs. ## Common mistakes * **Connecting a member account in organization mode.** Organization mode requires the management account. If BRM reports the role is in a member account, either launch the stack in the management account instead, or switch to single-account mode for that account. * **Skipping the billing toggles.** If Cost Explorer was never enabled or "IAM access to billing information" is off, the connection succeeds but spend data can't be read. Both toggles live in the Billing console of the connected account. * **The stack fails with a role-name error.** The account already has a `BRMIntegrationRole` from an earlier launch. Delete the old stack first (CloudFormation → Stacks), then relaunch. * **Connecting the wrong account.** Marketplace agreements are only visible from the account that purchased them. If your subscriptions were bought in a different account, connect that account too (or cover it with the StackSet). * **Deleting the stack or role after connecting.** This immediately cuts off BRM's access — which is exactly what to do if you ever want to disconnect, but do it deliberately. ## Provider documentation Our steps above should stay current, but if AWS changes their interface, these are the source-of-truth docs: * [Enabling Cost Explorer](https://docs.aws.amazon.com/cost-management/latest/userguide/ce-enable.html) * [Activating IAM access to billing information](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/control-access-billing.html#ControllingAccessWebsite-Activate) * [Creating a CloudFormation stack](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-console-create-stack.html) * [StackSets with AWS Organizations](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-enable-trusted-access.html) * [AWS Organizations terminology](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html) ## Still stuck? Reach out to BRM support and let us know which step you're stuck on. There's no secret credential involved in this integration, so it's safe to share the role ARN or a screenshot of the CloudFormation Outputs tab with support. # Azure AI Foundry Usage Integration Source: https://docs.brm.ai/azura-ai-foundry-usage-integration This article walks you through connecting your Azure AI Foundry resources to BRM to better understand and track your team's AI spend and usage. ***Why this matters:***\_ AI spend on Azure often hides inside a much larger cloud bill. This connection gives you a clear, resource-level view of what's actually running through Azure AI Foundry.\_ ⚠️ **Important:** This is **not** an Azure OpenAI or Foundry inference API key. BRM needs Microsoft Entra **service-principal client credentials** — a different kind of credential created in Azure's Entra admin tools. BRM uses these credentials to read your Azure AI resources and their Cost Management spend data. It does not use them to run inference, deploy models, or read prompts/responses. ℹ️ BRM backfills up to a year of daily spend history from Azure Cost Management, broken down by Foundry resource and billing meter. Where a resource has a single model deployment, BRM attributes that spend to the model. ## What you'll need You'll end up with four values to enter into BRM: | **Tenant ID** | Your Microsoft Entra tenant | | :- | :- | | **Subscription ID** | The Azure subscription containing your Foundry resources | | **Client ID** | The app registration's Application (client) ID | | **Client secret** | The secret **value** (not the Secret ID) | **Roles needed**, assigned at the subscription level: * Reader — lets BRM list Azure resources and Foundry deployments * Cost Management Reader — lets BRM read Azure Cost Management spend data **Who can do this:** An Azure admin who can create app registrations and assign subscription-level roles — usually a subscription **Owner** or **User Access Administrator**. ## Step 1: Identify the right subscription Confirm which Azure subscription contains the Azure AI Foundry resources you want BRM to track. If your Foundry resources span multiple subscriptions, repeat this setup for each one — or contact BRM support to discuss a custom setup. ## Step 2: Create an app registration In Azure Portal, go to [**Microsoft Entra ID → App registrations → New registration**](https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal). Name it "BRM AI Usage". Double-check you're creating this in the correct Microsoft Entra tenant — the one tied to the subscription from Step 1. ## Step 3: Copy the tenant ID and client ID On the app's overview page, copy the **Application (client) ID** and the **Directory (tenant) ID**. You'll need both later. ## Step 4: Create a client secret Go to [**Certificates & secrets → Client secrets → New client secret**](https://learn.microsoft.com/en-us/entra/identity-platform/how-to-add-credentials). ## Step 5: Copy the secret value Copy the secret's **Value** column right away — it's only shown once. Don't copy the Secret ID; BRM needs the Value. ## Step 6: Assign the Reader role Go to [**Subscriptions → \[your subscription\] → Access control (IAM) → Add role assignment**](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal). Assign the **Reader** role to the BRM AI Usage app. ## Step 7: Assign the Cost Management Reader role Repeat the role assignment, this time choosing [**Cost Management Reader**](https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/assign-access-acm-data), at the same subscription scope. ℹ️ Azure role assignments can take a few minutes to take effect. If BRM's connection test fails right after this step, wait a few minutes and try again. ## Step 8: Enter everything in BRM In BRM, open the Azure AI Foundry integration setup, found by clicking on your profile in the lower-left-hand corner of the screen, navigating to Integrations, then clicking "Connect" next to "**Azure Foundry**", and enter: * Tenant ID * Client ID * Client secret (the Value, not the Secret ID) * Subscription ID BRM will confirm the connection and begin pulling in spend data. Screenshot 2026 07 09 At 2 52 21 PM ## If you'd rather use the command line If your team is comfortable with Azure CLI, this whole setup can be scripted: ```bash theme={null} AZURE_SUBSCRIPTION_ID="00000000-0000-0000-0000-000000000000" az account set --subscription "$AZURE_SUBSCRIPTION_ID" APP_ID=$(az ad app create --display-name "BRM AI Usage" --query appId -o tsv) az ad sp create --id "$APP_ID" # The printed value is the client secret. Copy it directly into BRM. az ad app credential reset \ --id "$APP_ID" \ --append \ --display-name "BRM AI Usage secret" \ --years 1 \ --query password \ -o tsv az role assignment create \ --assignee "$APP_ID" \ --role "Reader" \ --scope "/subscriptions/$AZURE_SUBSCRIPTION_ID" az role assignment create \ --assignee "$APP_ID" \ --role "Cost Management Reader" \ --scope "/subscriptions/$AZURE_SUBSCRIPTION_ID" az account show --query "{tenantId:tenantId, subscriptionId:id}" -o json ``` ## Security notes * Both roles are read-only. BRM cannot run inference, deploy models, change Azure resources, change billing settings, or read prompt/response content. * You can rotate or revoke the client secret at any time in Microsoft Entra ID. Note that revoking the secret stops BRM's syncing until you enter a new one by reconnecting the integration in BRM. * If your organization manages costs at a management group, billing account, billing profile, or invoice-section level instead of per-subscription, contact BRM support before setup — this guide covers the standard subscription-level setup only. ## Common mistakes * **Using an Azure OpenAI or Foundry inference key instead of Entra client credentials.** These are different credential types. * **Copying the Secret ID instead of the secret Value.** BRM needs the Value. * **Creating the app registration in the wrong Microsoft Entra tenant.** * **Granting Cognitive Services permissions but forgetting subscription-level Reader and Cost Management Reader.** * **Assigning Reader but forgetting Cost Management Reader.** The initial connection test will still pass — it only checks that BRM can see the subscription — but no spend data will ever arrive. If the integration connects but stays empty, check this role first. * **Testing the connection immediately after assigning roles.** Give this a few minutes — Azure role assignments take time to propagate. * **Connecting only one subscription when Foundry resources live across several.** Set up one integration per subscription, or talk to BRM support about a custom setup. ## Provider documentation Our steps above should stay current, but if Microsoft changes their interface, these are the source-of-truth docs: * [Register a Microsoft Entra app and create a service principal](https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal) * [Add client secrets](https://learn.microsoft.com/en-us/entra/identity-platform/how-to-add-credentials) * [Assign Azure roles](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal) * [Assign access to Cost Management data](https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/assign-access-acm-data) * [Azure Cost Management Query API](https://learn.microsoft.com/en-us/rest/api/cost-management/query/usage) * [Plan and manage Microsoft Foundry costs](https://learn.microsoft.com/en-us/azure/foundry/concepts/manage-costs) * [Azure AI Services deployments API](https://learn.microsoft.com/en-us/rest/api/aiservices/accountmanagement/deployments?view=rest-aiservices-accountmanagement-2024-10-01) ## Still stuck? Reach out to BRM support and let us know which step you're stuck on. Don't send your client secret over email or chat — we'll point you to a secure way to share it if needed. # Claude MCP Source: https://docs.brm.ai/brm-mcp Connect BRM to your Claude workspace using the Model Context Protocol (MCP) so you can query vendors, agreements, and spend data directly from Claude. ## Overview The BRM Model Context Protocol (MCP) connector lets you interact with your BRM data directly inside a Claude workspace. Once connected, you can ask Claude questions about your vendors, agreements, renewals, transactions, and more — without leaving the conversation. MCP is an open standard that allows AI assistants like Claude to securely connect to external data sources. The BRM connector uses this protocol to give Claude read access to your organization's BRM instance. ## Prerequisites Before getting started, confirm the following: * Your organization has an active BRM account. * An administrator has access to your Claude organization settings. * Users connecting individually have an active BRM login. ## Administrator Setup An administrator must add the BRM connector to the organization before individual users can connect. Navigate to **Organization Settings → Connectors** in your Claude workspace. Click **Add** in the top-right corner and select **Custom**. Fill in the following fields: | Field | Value | | - | - | | **Name** | `BRM` | | **URL** | `https://api.brmapp.net/mcp-worker/mcp` | You only need to complete the administrator setup once. After the connector is added, every user in your organization can connect individually. ## User Connection Guide Once an administrator has enabled the connector, follow these steps to connect BRM to your personal Claude workspace. Log into your workplace Claude instance. Go to **Settings → Connectors**. In the **Custom Connectors** section, find the **BRM** entry and click **Connect**. A new browser tab will open. Click **Accept** to authorize BRM to share data with your Claude workspace. ## Configuration & Preferences To customize your experience after connecting: 1. Return to **Settings → Connectors** in Claude. 2. Find the **BRM** connector and click **Configure**. 3. Adjust approval request settings and other personal preferences to match your workflow. ## What You Can Do Once connected, you can ask Claude questions like: * "Which agreements are renewing in the next 90 days?" * "Who owns the Salesforce vendor relationship?" * "Show me our top 10 vendors by spend." * "What's the total contract value for our AWS agreement?" * "List all pending procurement requests." Claude will query your BRM data in real time and return answers directly in the conversation. ## Need Help? If you encounter any issues during setup or connection, reach out to our support team at [support@brm.ai](mailto:support@brm.ai). Learn about all the ways to interact with AI across BRM. See all available BRM integrations. # Cloudflare Workers AI Usage Integration Source: https://docs.brm.ai/cloudflare-workers-ai-usage-integration This article walks you through connecting your Cloudflare account to BRM so we can show your team's Workers AI spend, usage, and free-tier consumption. ***Why this matters:*** *Workers AI usage is billed in Cloudflare's own unit — Neurons — and sits inside your broader Cloudflare bill, which makes it hard to see what your AI workloads actually cost. This connection breaks it out for you.* ⚠️ **Important:** BRM needs a **Cloudflare API token with the Account Billing Read permission** — not a Workers AI inference API token, and not your Global API Key. BRM uses this token to read your account's daily billable usage. From that, BRM shows spend in dollars, usage in Neurons, and how much of Cloudflare's free daily Neuron allowance you're consuming. BRM cannot run inference, deploy Workers, change account settings, or read prompts/responses with this token. ℹ️ BRM backfills up to a year of daily usage and spend history, and tracks Cloudflare's free tier of 10,000 Neurons per day — so you can see the value you're getting from the free allowance even before you're paying anything. ## What you'll need | **Credential** | Cloudflare API token with Account Billing Read permission | | :- | :- | | **Also needed** | Your Cloudflare account ID | | **Who can do this** | A Cloudflare user with Administrator or Billing access on the account | ## Step 1: Find your account ID Sign in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select the account that runs your Workers AI traffic. Your **account ID** is shown on the account's overview page (in the right-hand sidebar, or under **Manage Account**). You'll enter this into BRM later. If you belong to several Cloudflare accounts, double-check you're in the right one — a token created for the wrong account won't show the data you expect. ## Step 2: Open the API token creation page Go to [Create an API token](https://dash.cloudflare.com/profile/api-tokens) (click your profile icon → **My Profile → API Tokens**), then click **Create Token**. ## Step 3: Create a custom token Scroll to **Custom Token** and click **Get started**. Name the token BRM AI Usage. ## Step 4: Set the permission Under **Permissions**, choose **Account → Billing → Read**. Under **Account Resources**, select the specific account from Step 1. ## Step 5: Create and copy the token Click **Continue to summary**, then **Create Token**. Copy the token right away — Cloudflare only shows it once. ## Step 6: Enter everything in BRM In BRM, open the Cloudflare Workers AI integration setup, found by clicking on your profile in the lower-left-hand corner of the screen, navigating to Integrations, then clicking "Connect" next to "**Cloudflare Workers AI**", and enter: * Your Cloudflare account ID * The API token BRM will confirm the connection and begin pulling in usage data. Screenshot 2026 07 09 At 3 17 39 PM ## Multiple accounts Set up **one BRM integration per Cloudflare account**. If you run Workers AI in several Cloudflare accounts, create a token in each account and connect each one separately in BRM. ## Security notes * The Billing Read permission is read-only. BRM cannot run inference, deploy or modify Workers, change billing or account settings, or read prompt/response content. * You can roll or revoke the token at any time from the Cloudflare dashboard's API Tokens page. Note that revoking the token stops BRM's syncing until you enter a new one by reconnecting the integration in BRM. * Consider leaving the token's TTL unset (no expiry). If you do set an expiry, BRM's syncing will stop when the token expires until you reconnect with a fresh token. ## Common mistakes * **Using a Workers AI inference token or your Global API Key instead of a Billing Read token.** BRM reads billing data, so it needs the Account Billing Read permission specifically. * **Creating the token under the wrong Cloudflare account.** The token's Account Resources scope must include the account whose usage you want BRM to track. * **Entering something other than the account ID.** BRM needs the 32-character account ID from the dashboard — not your account name, email, or a zone ID. * **Not copying the token right away.** Cloudflare only shows it once. If you miss it, create a new one. * **Expecting per-model or per-user breakdowns.** Cloudflare's billing data reports Workers AI usage by billing meter (in Neurons), not by individual model or user. ## Provider documentation Our steps above should stay current, but if Cloudflare changes their interface, these are the source-of-truth docs: * [Create an API token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/) * [API token permissions](https://developers.cloudflare.com/fundamentals/api/reference/permissions/) * [Find your account ID](https://developers.cloudflare.com/fundamentals/account/find-account-and-zone-ids/) * [Workers AI pricing and Neurons](https://developers.cloudflare.com/workers-ai/platform/pricing/) ## Still stuck? Reach out to BRM support and let us know which step you're stuck on. Don't send your API token over email or chat — we'll point you to a secure way to share it if needed. # BRM Lite Onboarding Source: https://docs.brm.ai/content/get-started/brmlite We're excited to have you on board! Follow these quick steps to start getting value from BRM right away. ### 1. Bring your contracts into BRM * Connect your email so BRM can automagically collect vendor contracts. * Make sure teammates who sign contracts connect their emails too. * Using a Google Group like [contracts@yourcompany.com](mailto:contracts@yourcompany.com)? If any group member connects their work email to BRM, BRM will collect all contracts sent to the group. * Prefer to upload files? You can import agreements directly. ### 2. Review an verify your agreements * We make it easy to confirm what's in your system * Too many contracts to go through yourself? Email us at [support@brm.ai](mailto:support@brm.ai), and we'll verifiy them of you. ### 3. Set up notifications for you and your team so you never miss a renewal * Connect Slack and fine-tune your email notifications * Sync your BRM Renewal Calendar with your work calendar to stay on top of renewal deadlines. * Assign business owners to your vendors and invite them to BRM so they get notified about upcoming reneals for the softwares they own. Need help? Reach out anytime at [support@brm.ai](mailto:support@brm.ai) # Product Overview Source: https://docs.brm.ai/content/get-started/product-overview ## What can BRM do? ### Let your systems talk to each other Software and vendor management involves multiple functions and their respective systems: Finance operates out of NetSuite, IT out of Okta, Legal out of Ironclad, etc. BRM integrates these systems, enabling you to make intelligent decisions with all necessary data at your fingertips. ### Never miss a renewal With your systems interconnected and agreements ingested, BRM provides complete visibility on upcoming renewals. This allows you to proactively manage renewals, avoiding the pitfalls of reactivity. ### Set your criteria and leverage the BRM Listings network Different departments can define their own criteria, the set of requirements that softwares and vendors must meet. This simplifies the process for line-of-business owners and vendors during intake. BRM’s global listings align with your standard criteria, making purchasing more straightforward than ever. ### Streamline renewals and new purchases Key steps in the purchasing process are often overlooked. Risk assessments, for instance, are sometimes conducted only after a vendor is paid and onboarded. BRM Requests ensure that no aspect is neglected and all criteria are considered prior to integrating a software or vendor into the organization. # What is BRM? Source: https://docs.brm.ai/content/get-started/what-is-brm BRM is an AI powered collaboration tool that empowers companies to find, evaluate, purchase, and manage software and vendors. This is made possible by automagically connecting your vendor-related systems (spend management, IAM/SSO, legal, compliance, info sec) together into a single, unified system of record. Our mission is to help people produce their best work product through arming them with the right tools. ## Why does BRM exist? ### Buying problems aren’t cheap Companies are perpetually buying, renewing, and paying for vendors. Whether it's finding new software, knowing what you already use, or reading through a contract––buying is messy, and hard. Ultimately, this means companies waste time and money, and aren’t equipping their teams with the right tools. ### Selling is streamlined while buying is chaotic Over the years, software has been developed for every aspect of the selling process, starting with the CRM. Meanwhile, collaborating while buying happens across siloed point solutions, and horizontal productivity softwares. ### The easy questions aren’t so easy With companies focused on growth and their own customers, it's typical to lose track of what softwares you use, and how quickly spend can creep up. It’s about time buyers had a horizontal software platform that could answer basic questions with ease. # Deel integration Source: https://docs.brm.ai/content/integrations/HRIS/deel Description of your new file. ## **Overview** To authenticate Deel, you will need to provide the following information: * Organization Token ## **Prerequisites** * You must be a Deel admin to complete the linking flow * Your Deel account must have API access enabled. Contact your Deel account manager to confirm if you are unsure of this ## **Instructions** ### Method 1: User Credentials This method is preferred and much quicker and easier. **Step 1: Click “Connect” on the Deel integration** Select `Use my credentials (recommended)` DEEL1 Pn **Step 2: Click through the modal and a login window will pop-up** BRM will only read data on employees, their employment status, and reporting line DEEL2 Pn **Step 3: Login to Deel and click allow** Note: the auth screen consists of boilerplate language, BRM will not manage anything in Deel and can only read data on employees, their employment status, and reporting line DEEL3 Pn ## Method 2: API Token **Step 1: Create an organization token** 1. In your Deel portal, go to Apps & Integrations on the left-hand side 2. In the upper right, go to developer center 3. Click generate new token under organization tokens 4. Label your organization token and click next 5. Select all scopes to add to your organization token and click generate DEEL4 Pn DEEL5 Pn DEEL6 Pn DEEL7 Pn DEEL8 Pn **Step 2: Enter your token in the linking flow** DEEL9 Pn # UKG Integration Source: https://docs.brm.ai/content/integrations/HRIS/ukg ## **Step One: Find your UKG Pro Customer API Key.** 1. You'll want to login to your UKG Pro account and search Service Account Administration in your search bar on the top right. 2. Copy the Customer API Key from under the header. 3. Paste the Customer API Key in Merge Link. ## **Step Two: Create your Service Account** 1. On the UKG Pro Service Account Administration Page, click on "+ add" in the upper right hand side. 2. Enter in the admin of your UKG Pro account's username and email. You will need the username later. 3. Scroll down under Web Service to enable permissions. **View Employee Person Details** is the **minimum requirement** to authenticate your account with Merge. Depending on the use case, you may be required to add some, or all, of these permissions: * Employee Pay Statement * Employee Employment Information * PTO Plan Integration * Company Configuration Integration * Payroll Integration * Personnel Integration * Employee Job History Details * Employee Person Details * Employee Compensation Details 4.) Click Save. Your new password will pop up. Save the password in a secure location. 5.) Enter your UKG Pro service account credentials in Merge Link and click Submit. This should be the user name of your admin service user and the password you just generated. ## **Step Three: Finding your UKG Web Service Domain.** 1.) In your search bar, search for Web Services. 2.) Look at any of the "web service endpoint URLs" and find your subdomain. For example if your URL is, [http://Servicet.ultipro.com/services/BIDataService](http://Servicet.ultipro.com/services/BIDataService) then your subdomain is "**Servicet**". 3.) Find your top-level domain. For example if your URL is, [http://Servicet.ultipro.com/services/BIDataService](http://Servicet.ultipro.com/services/BIDataService) then your top level domain is "[**ultipro.com**](http://ultipro.com)". ## **Step Four: Complete Merge Link** On the "Enter your UKG Pro Web Services URL (Part 1) screen, enter your **subdomain**. Click Submit. On the "Enter your UKG Pro Web Services URL (Part 2)" screen, select the URL that matches your **top level domain.** # Netsuite Integration FAQ Source: https://docs.brm.ai/content/integrations/accounting-erp/netsuite-faq Common questions about connecting BRM to Netsuite ### What BRM Reads from NetSuite BRM's integration with Netsuite is view only. This integration allows BRM to securely access NetSuite data needed for procurement and expense workflows—without making any changes to your NetSuite environment. This includes details about the vendors you pay, the frequency of payments, and the amounts being paid. In NetSuite terms, BRM needs view access to accounts, contacts, expense transactions (such as bill payments and direct expenses), and the web API. All access is scoped, view-only. ### Permission Scope BRM has **view-only access** to the following NetSuite records: **Transactions – Vendor** * Bills * Bill Purchase Orders * Vendor Credits * Vendor Returns * Vendor Payments * Vendor Return Authorizations **Transactions – Customer** * Invoices * Sales Orders * Customer Payments * Customer Refunds **Transactions – General Financial** * Credit Memos * Deposits * Deposit Applications * Expense Reports * Cash Sales and Refunds * Statements **Transactions – Inventory** * Item Receipts * Inventory Adjustments * Inventory Transfers * Build/Unbuild Assemblies **Finance and Accounting** * Pay Bills * Pay Sales Tax * Currency Revaluation * Refunds * Reconciliations * Journal Entries **Administrative Utilities** * Estimates * Credit Cards * Posting Periods * System Journals * Audit Trail * Transfer Funds * Opening Balances * Return Authorizations * Approval Statuses ### Access and Security BRM’s NetSuite integration uses a scoped, view-only role. Only the minimum necessary records are accessed. No write access is granted to any records. ### What can BRM do in our system? BRM **can** pull your expense data and enrich it with other sources, such as contracts, HR data, user activity, etc. However, it **cannot** make changes in NetSuite, meaning it cannot create bills, journal entries, or make edits. BRM’s access is strictly limited to view-only. ### Can BRM change its own permissions? No. BRM cannot modify its own permissions. As the NetSuite admin, you control BRM’s permissions. BRM will provide a list of required view-only permissions required for BRM to work properly. Its access will not change unless you update it. ### Does BRM have access to our login credentials? No. BRM can **never** see or store your NetSuite credentials (username or password), or log in to your NetSuite account. ### How do permissions work? A virtual role must be created in NetSuite and assigned specific permissions. BRM uses a secure token (a system-generated password) to access that role. The token works only within the limits of the assigned role. ### What about other data? Can BRM see revenue or transactional data? * No, BRM does not require revenue or transactional data and will not request access. Can BRM see payroll data? * No, payroll data is not required and will never be part of BRM’s access. ### Can BRM see journal entries? No. BRM doesn't have access to journal entries in Netsuite. ### Does BRM surface the NetSuite vendor ID in BRM? No. BRM can't automatically show the NetSuite vendor ID on vendors in BRM. BRM intelligently merges duplicate NetSuite vendors, so Netsuite ID's don't always match 1:1 with BRM vendors. # Netsuite Integration Source: https://docs.brm.ai/content/integrations/accounting-erp/netsuite-token This article covers specific instructions on how to connect Netsuite Token-Based Authentication to BRM. If you would like an overview of how the integration works, read our FAQ here. ## **Prerequisites** Please ensure you have **Administrator** permissions in your company's NetSuite instance, or someone has shared their access with you. This is for BRM Enterprise users. ## **Step One: Finding your NetSuite Account ID** 1. Log into your NetSuite portal. 2. Copy the subdomain of the URL at the top of your browser and enter it within Merge Link. * Your NetSuite Account ID is the combination of letters or numbers before "[app.netsuite.com](http://app.netsuite.com)" * For example, if your URL is "[**https://7600508.app.netsuite.com/app/center/card.nl?sc=-29\&whence=**](https://7600508.app.netsuite.com/app/center/card.nl?sc=-29\&whence=)", the value to input within Merge Link is **7600508** Netsuite1 Pn *** ## **Step Two: Enable Web Services** 1. Open the NetSuite [Enable Features Page](https://system.netsuite.com/app/setup/features.nl) 2. Under SuiteCloud, check the following boxes then click save 1. **SOAP WEB SERVICES** 2. **REST WEB SERVICES** 3. **TOKEN-BASED AUTHENTICATION** Netsuite2 Pn *** ## **Step Three: Install the AccountLink NetSuite bundle** 1. Install the following Permissions Bundle 1. [**Merge Read-only Permissions Bundle**](https://system.netsuite.com/app/bundler/bundledetails.nl?sourcecompanyid=7600508\&domain=PRODUCTION\&config=F\&id=480015) will allow for read-only access 2. It may take up to 5 minutes to install and you may be re-routed to the Installed Bundles page when the installation is complete Netsuite3 Pn [***The bundle creates a role that can authenticate to NetSuite's API. For a full list of the role's permissions, see this article. The permissions may be updated, or a separate Role may be used, but doing so could result in permission issues.***](https://help.merge.dev/en/articles/8250738-netsuite-bundle-details#h_b3d0a0731b) *** ## **Step Four: Assign User to Token-based Authentication Role** 1. Open [Manage Users](https://system.netsuite.com/app/setup/listusers.nl?whence=) 2. Either select a user to assign the Role to or create a new user * Most users use an existing user (often yourself) so that an additional NetSuite seat is not consumed * To create a new user, however, go to *Lists > Employees > Employees > New*. Create the user and grant them NetSuite access by going to the \*\*Access tab \*\*in the Employee record and select **'Give Access'** 3. In the user's employee record, click Edit and go to the Access tab. In your Access tab, go to Roles and select the Role you imported through the Import Bundle process in Step 3 Netsuite4 Pn 4. Click **Save** to apply these changes *** ## **Step Five: Create an integration to obtain your Consumer Key and Secret** 1. Navigate to [Integration](https://system.netsuite.com/app/common/integration/integrapp.nl?whence=) and create an integration with the following details * **NAME**: any value * \*\*CONCURRENCY LIMIT: \*\*leave blank * \*\*CALLBACK URL: \*\*[https://app.merge.dev/oauth/callback](https://app.merge.dev/oauth/callback) * **REDIRECT URI**: [https://app.merge.dev/oauth/callback](https://app.merge.dev/oauth/callback) * **Check the following boxes** * REST WEB SERVICES * TOKEN-BASED AUTHENTICATION * TBA AUTHORIZATION FLOW Netsuite5 Pn ​ 1. Once you click save, Copy the **Consumer Key** and **Consumer Secret** and store them in a safe place. They will only be shown once and you will need to enter it in [Step 7](https://help.merge.dev/en/articles/9939164-netsuite-how-do-i-link-my-account-abe#h_8b85cb6bcb).\ ​ Netsuite6 Pn ## **Step Six: Creating an Access Token to Obtain your Token ID and Secret.** 1. Navigate to [Access Token](https://7600508-sb1.app.netsuite.com/app/setup/accesstoken.nl?whence=) 2. Ensure the below details are selected and click **Save** * \*\*Application Name: \*\*Name of the Integration created in Step 5 * **User:** User that the Role was added to during Step 4 * **Role:** The imported role (Merge Full Permissions or Merge Read-only Permissions)\ ​ Netsuite7 Pn 3. Copy the **Token ID** and **Token Secret** and store them in a safe place. They will only be shown once and you will need to enter it in Step 7. Netsuite8 Pn ## **Step Seven: Paste your Netsuite Consumer Key and Secret, and Token ID and Secret in Merge Link.** Netsuite9 Pn 1. CONSUMER\_KEY: Confirmation screen after creating the integration (Step Five) 2. CONSUMER\_SECRET: Confirmation screen after creating the integration (Step Five) 3. TOKEN\_ID: From confirmation screen after creating your Access Token (Step Six) 4. TOKEN\_SECRET: From confirmation screen after creating your Access Token (Step Six) \*\*If you have any questions, please don’t hesitate to reach out to \*\*[**support@brmlabs.co**](mailto:connor@brmlabs.co) # Quickbooks Online Source: https://docs.brm.ai/content/integrations/accounting-erp/quickbook How to integrate QBO * Navigate to the `Integrations Page` on BRM * Click `Connect` on the Quickbooks Integration * You will be asked to login to QBO (admin required) * Login and connect the QBO subsidiary(s) to BRM # Brex integration Source: https://docs.brm.ai/content/integrations/credit-card/brex Description of your new file. ### Requirements * Have `Admin` role in Brex ### Step 1: In BRM, head to Settings -> Integrations -> Brex ### Step 2: Login to Brex 1. In the new tab that opens, log into your Brex account 2. Authorize BRM to integrate with Brex # Ramp Integration Source: https://docs.brm.ai/content/integrations/credit-card/ramp Description of your new file. ### Requirements * Have `Admin` or `IT Admin` role in Ramp ### Step 1: In Ramp navigate to Company, and click on `Developer` Clean Shot 2026 06 28 At 14 28 02@2x ### Step 2: Create a new app 1. Click `Crate new app` 2. Name the app and add a description ### **Step 3: Change the app’s grant type to “Client Credentials”** 1. Click on the app that you just created (in this demo `BRM Integration`) 2. Delete the default grant type that is `Authorization Code` 3. Add a new grant type that is `Client Credentials` ### Step 4: Configure the app’s scopes by enabling the following permissions 1. In your app config, scroll down to `Configure required scopes` 2. Toggle the following scopes on 1. bills:read 2. cards:read 3. cards:write 4. limits:read 5. limits:write 6. memos:read 7. receipts:read 8. reimbursements:read 9. transactions:read 10. users:read ### Step 5: Enter the Ramp app’s Client ID and Client Secret into BRM 1. Head to BRM and navigate to your integrations (Settings —> Integrations) 2. Add Ramp as an integration 3. Copy over the `Client ID` and `Client Secret` from your Ramp app into your BRM modal For more information, and if any of these steps appear to have changed within Ramp, you can [view Ramp's instructions here](https://support.ramp.com/accessing-the-developer-api/). # Integration Overview Source: https://docs.brm.ai/content/integrations/integration A vendor relationship is never contained in one place — it's scattered across contracts, invoices, logins, and conversations that no single system was ever built to see whole. Every integration you connect gives BRM another layer of that relationship: performance and access data from your identity providers, spend and payment history from your finance and cloud tools, headcount and departures from HR, usage from your AI stack. On their own, these are just disconnected feeds. Connected through BRM, they become one structured, always-current record of every relationship your business depends on — the foundation Charter needs to watch, work, and deliver judgment before you have to ask. ### **Identity and Access Management** Connect your IAM to monitor how many teammates are logging into and using specific tools. This integration helps identify underutilized vendor software across your organization. **Supported Integrations:** * Okta * Google * Microsoft * Cerby ### **Email** These integrations sync your inbox to BRM for automatic vendor contract collection. **Supported Integrations:** * GSuite * Microsoft 365 ### **Finance & Accounting** These integrations sync your accounting ledger and credit card transactions with BRM in real time, helping ensure accurate financial tracking and streamlined vendor expense management. **Supported Integrations:** * QuickBooks * NetSuite * Sage Intacct * Brex * Ramp * Mercury * Plaid ### **HR & Workforce Management** Connect your HRIS to gain a centralized view of how your team engages with company tools. BRM tracks employee departures and seat allocations, helping you compare tool usage against assigned licenses. **Supported Integrations:** * ADP Workforce Now * BambooHR * ChartHop * Deel * Gusto * HiBob * Justworks * Namely * Paylocity * UKG Pro Workforce Management * UKG Pro * UKG Ready * Workday * Zenefits ### \*\*Communication & Collaboration: \*\* When integrated with Slack, all users become assignable profiles within BRM, making it easy to designate vendor or tool ownership. You’ll also receive BRM notifications—such as contract verifications, renewal reminders, and vendor info—directly within Slack, without leaving your communication platform. **Supported Integrations:** * Slack ### **Cloud** Connect your cloud provider to track marketplace agreements, spend, and usage-based consumption across your cloud infrastructure. **Supported Integrations:** * [AWS](https://docs.brm.ai/aws-integration) ### **AI Usage & Spend** Connect your AI model providers to track token usage, spend, and quota consumption across your AI stack—giving you visibility into a fast-growing and often under-monitored category of vendor spend. **Supported Integrations:** * [Anthropic](https://docs.brm.ai/anthropic-ai-usage) * [OpenAI](https://docs.brm.ai/open-ai-usage-integration) * [OpenRouter](https://docs.brm.ai/openrouter-integration) * [Cursor](https://docs.brm.ai/cursor-usage-integration) * [Cloudflare Workers AI](https://docs.brm.ai/cloudflare-workers-ai-usage-integration) * [Azure Foundry](https://docs.brm.ai/azura-ai-foundry-usage-integration) * [Gemini Enterprise Agent Platform](https://docs.brm.ai/google-vertex-ai-usage-integration) * [xAI](https://docs.brm.ai/xai-usage-integration) * [AWS](https://docs.brm.ai/aws-integration) # Slack integration Source: https://docs.brm.ai/content/integrations/messaging/slack BRM’s Slack integration allows BRM to send notifications to **users that opt-in** and to access BRM’s co-pilot assistant. BRM’s Slack bot will never message a user that is not a user in BRM or does not have Slack notifications enabled. Users, with the right permissions, can also message the BRM Slack bot to instantly and intelligently retrieve information about their vendors, software, and agreements on the go without having to enter the app. Learn more about the functionality of our Slack integration [here](/product-features/slack/overview-slack). * Step 1: Head to Settings > Integrations * Step 2: Find and click connect on the Slack integration * Step 3: Login to your workspace and authenticate via Slack # BRM for Approvers Source: https://docs.brm.ai/content/use-case/brm-for-approvers BRM entrusts approvers with validating softwares and vendors before purchase, during use, and upon renewal. It caters to key areas like finance, legal, compliance, and IT, highlighting that even free solutions need thorough vetting to avoid risks and ensure they meet company policies. ## Criteria and Request Configuration As an approver, ensure your review process is integrated into BRM by setting up your Criteria and configuring each Request Type accordingly. ### Configure Criteria Criteria represent the information stored in BRM’s records. Changes to criteria affect all platform aspects—softwares, tables, requests, etc. Establishing solid criteria initially is crucial. 1. Navigate to Settings → Criteria. 2. Toggle the desired fields in your BRM. 3. Use the "+" button to add criteria (with name, description, and datatype). ### Configure Requests Requests align with your Criteria, letting you tailor processes uniquely. For instance, an organization’s renewal process might be more streamlined than a new purchase. 1. Go to Settings → Requests. 2. Choose and configure the request type. 3. Edit request steps as needed. 4. Adjust specific fields within steps based on your Criteria. 5. Include or exclude fields, and set whether "N/A" is an acceptable response. ## Request Approvals After setting Criteria and Requests, the next steps involve approvals. Each Request Step corresponds to a function with a designated approver. Upon submission, the approver reviews the step. ### Field Approval Approvers can validate individual fields, allowing reviews to start as information is collected. ### Step Approval Direct step approval is possible without field-by-field approval. Once approved, steps can be unapproved, but subsequent steps will not be reversed. # BRM for Owners Source: https://docs.brm.ai/content/use-case/brm-for-owners Description of your new file. ### Status Responsibility An owner's main duty is to maintain the softwares and vendors they oversee in good order. This encompasses ensuring user licenses are correctly provisioned, maintaining software compliance, keeping documentation current, and addressing renewals proactively. These responsibilities are reflected in the software's status. In the example below, the owner, Connor, sees that one of his softwares has dropped to `Warning`. He investigates and finds a comment from Compliance indicating that the SOC2 is outdated, and he promptly uploads the latest version. # BRM for Requestors Source: https://docs.brm.ai/content/use-case/brm-for-requestors In BRM, any employee can create, submit, and collaborate on a request. You can initiate a request through the UI, or simply ask brAIm to do it for you. Outlined below are the guidelines to creating and completing a request. For more details on the request data model, see [Requests](https://www.notion.so/Requests-f7d19e6a40994a4f96810b5789475cf2?pvs=21) ### Create a Request 1. Click the global "+" button to initiate a request. 2. Choose the type of request. 3. Designate a champion (Champ) to lead the request process. 4. Complete the basic details of your request. ### Complete a Request Step 1. The Champ collects necessary data as defined by the request process and ensures the completion of requests. 2. Leave comments and @mention others as needed for assistance with the request. 3. If a field does not apply, select the “No Field” option below it. 4. Once a step is finished, submit it for review and approval. 5. Following approval, subsequent steps will be initiated until the request is fully completed. # Contract Collector Email Notification Cadence Source: https://docs.brm.ai/contract-collector-notification-cadence BRM's Contract Collector is always at work finding new documents and matching them to the right Agreements in your BRM. Whenever it finds a vendor-related document, our Agents automatically extract key terms and add them where they need to go, building you a more complete view of commitments, spend, renewals, and your vendor relationships —automagically. By default, we alert you whenever Contract Collector finds a vendor document. However, you may prefer to receive daily, weekly, or monthly summaries of what Contract Collector finds, rather than receive one email per document. This article explains how to control how often you're notified when new documents are found. ## Notification cadence options Summary notifications include the count of documents found and links to review them in BRM. No matter which cadence you choose, BRM continues collecting and processing documents in the background. Below are your notification cadence options: * **Per document:** You're notified each time a new document is found. This is the default. * **Daily summary:** You receive one notification per day summarizing all documents found in the last 24 hours. * **Weekly summary:** You receive one notification per week summarizing all documents found in the last 7 days. * **Monthly summary:** You receive one notification per month summarizing all documents found in the last 30 days. Email ## How to update your preference Once signed into BRM, follow these steps to update your preferences: 1. **Open Account Settings**\ Click your profile icon in the top-right corner of BRM, then select **Settings**. 2. In the left sidebar, click **Notifications**. 3. Find the Agreements Section\ Scroll to the **Agreements** section. You'll see notification controls for various agreement-related events. 4. Set Your Cadence\ Locate the **Documents found by Contract Collector** row. Click the dropdown and select your preferred frequency: **Per document**, **Daily summary**, **Weekly summary**, or **Monthly summary**. 5. Save \ Your preference is saved automatically. No additional confirmation is needed. **Tip**\ You can set this preference independently for **Inbox**, **Slack**, and **Email** notifications using the checkboxes in the same row. Batched Document Ingestion Emails ## Choosing the right cadence * **Per document** is best if you want to review and confirm each agreement as it arrives, or if your inbox doesn't generate many contracts. * **Daily summary** works well if you want to review newly-found agreements on a regular daily cadence alongside other finance tasks. * **Weekly summary** is a good fit for teams that do a scheduled weekly vendor or contract review. * **Monthly summary** is ideal if you have a mature agreement library and mostly want a periodic check on what was auto-captured. ## Need help? If you have questions about notification settings or Contract Collector, reach out to BRM support. # Cursor AI Usage Integration Source: https://docs.brm.ai/cursor-usage-integration This article walks you through connecting your Cursor team account to BRM so we can show your team's model usage, token usage, and per-user breakdowns. ***Why this matters:***\_ AI-native tools like Cursor let engineers pick the model inside the product, which makes spend almost impossible to attribute without this kind of data.\_ ⚠️ **Important:** BRM needs a **Cursor team Admin API key** — a team-level admin credential, not your personal Cursor editor token. BRM uses this key to read team members and usage events, including model usage, token usage, charged amounts (where Cursor reports them), and usage by user email. ## What you'll need | **Credential** | Cursor team Admin API key | | :- | :- | | **Who can create it** | A team admin on the Cursor dashboard | | **Where it's created** | Cursor dashboard → API Keys | ## Step 1: Sign in to the Cursor dashboard Sign in to the [Cursor dashboard](https://cursor.com/dashboard/api?section=team-keys#team-api-keys) using an account that is a **team admin**. Make sure you're in the correct team workspace before continuing. Keys created in the wrong workspace won't show the data you expect. ## Step 2: Open API Keys Open **API Keys** from the dashboard navigation. ## Step 3: Create a new key Click **New API Key**. ## Step 4: Name the key Tip: Name the key BRM AI Usage. ## Step 5: Set the scope Set the scope to read only to let BRM read AI usage data. ## Step 6: Copy the key Copy the key and paste it directly into BRM's integration setup screen. ## Step 7: Enter the key in BRM In BRM, open the Cursor integration setup and paste in the key. BRM will confirm the connection and begin pulling in usage data. Screenshot 2026 07 07 At 11 36 50 AM ## Common mistakes * **Using a personal Cursor account token instead of a team Admin API key.** Personal tokens won't work for this integration. * **Creating the key from the wrong team workspace.** Confirm you're in the team whose usage you want BRM to track. * **Expecting dollar amounts on every historical event.** Cursor usage events may include token usage even when older cost fields aren't available — this is normal. ## Provider documentation Our steps above should stay current, but if Cursor changes their interface, these are the source-of-truth docs: * [Admin API](https://cursor.com/docs/account/teams/admin-api) * [Analytics API](https://cursor.com/docs/account/teams/analytics-api) * [Cursor APIs overview](https://cursor.com/docs/api) ## Still stuck? Reach out to BRM support and let us know which step you're stuck on. Don't send your API key over email or chat — we'll point you to a secure way to share it if needed. \\ # Email in The Relationship Source: https://docs.brm.ai/email-relationship A vendor relationship is years of contracts, payments, and conversations. The Relationship View already assembles the contracts and the payments for you. Now it assembles the conversations too, and lets you act on all of it without leaving the page. Every email with a vendor sits on their relationship page, alongside what you signed, what you pay, and what they committed to. Reply to the vendor from there. Bring your team into the thread before anyone responds. And because BRM's agents are trained on the full relationship rather than the last message in your inbox, they can suggest what to do next and draft the email that does it. ✅ Available now for all BRM customers with a connected inbox ## **What Is Email in The Relationship?** Gone are the days of asking co-workers to search their inbox for context on a vendor Relationship, or trying to piece together the puzzle of a relationship previously managed by an employee who is no longer with the company. Now, every relevant vendor email informs and appears on each vendor Relationship in BRM. It even helps you build, manage, or end those relationships without having to leave BRM. Vendor threads appear in the Relationship timeline alongside agreements and transactions. Open one to read the full conversation, comment on it so a colleague can weigh in, and reply in place. Ask BRM to draft that reply, and it writes from the agreement terms, the spend history, the previous exchanges, and everything else assembled on the page. The practical effect is that the person handling a vendor conversation has the entire Relationship in hand, whether or not they signed the deal, sat in the negotiation, or were copied on the thread six months ago. Before we continue, let's address two questions you may have: * **Does my organization consider this address a contact on this Relationship?** This is managed by your team in the Contacts tab. * **Do I want my own emails with this address shared at all?** Managed by you, in your own settings. Affects only your messages. ## **Quick Start: Turning It On** **Setup takes about two minutes.** 1. **Log in to BRM** 2. **Go to My Account, then Communication** 3. **Connect your inbox.** Gmail or Microsoft Outlook, whichever you use for vendor correspondence. Connecting runs through your provider's sign-in and takes about 30 seconds. If you already connected an inbox for Contract Collector, you will need to reconnect your inbox to enable auto-drafting and email sending. 4) **Toggle on "Share this inbox for email drafts, AI summaries, contacts, and relationships."** Attachments only keeps things as they were, with BRM pulling in contracts and documents but leaving the conversation out. Attachments + vendor communication surfaces the content of your vendor threads on the relevant Relationship pages, where your team can see them. Communication 1 4. **Set your exclusions.** BRM suggests a starting set based on what most teams keep private. Review them and add any addresses or domains of your own. More on this below. Screenshot 2026 08 03 At 4 30 49 PM 💡 **TIP** You can change any of these at any time. Nothing here is a one-way door, and switching communication off stops new threads from surfacing immediately. If you mark an email as private, it will not show in the Relationship for others, but you will still be able to see it in your instance. ## **What You'll See** ### **1. The Full Conversation, in Context** Email threads appear as events in the Relationship activity timeline, in chronological order, alongside payments, logins, and agreement dates. Each shows the real subject line and the inbox it arrived in. The renewal conversation that started six months before the contract date. The escalation that got resolved. The commitment a CSM made over email that never made it into an amendment. All of it in sequence, on the page where the contract and the spend already live. This is what gives every other capability on this page its value. The drafts are good because the context is complete. Updated 2 ### **2. Agents That Know the Relationship** "Push back on the 12% increase and ask for a two-year term." BRM's agents are trained on the Relationship in front of them. They draft from the agreement, the spend trajectory, and every previous exchange with that vendor, rather than from the last message in the thread, which is all a normal email client can see. Sometimes the agent gets there first. Where BRM has already recognised something that needs a response, the thread opens with a draft ready to go. Adjust it by editing directly or by telling the agent what to change. Generated replies default to Reply all, with recipients editable before you send. The result is that renewal prep, price pushback, and chasing an overdue answer all start from a first draft that already reflects the Relationship, instead of a blank reply window and twenty minutes of research. 03 (1) ### **3. Reply to the Vendor Without Leaving the Page** Reply, reply all, and forward, all from the Relationship. The composer can be placed between messages in a thread, so you can respond in the right place in a long chain. Attachments are listed on each message and open in the main Relationship pane while the thread stays open beside them, so a contract sent over email is one click from the record it belongs to. Recipients stay editable throughout, so you can add a colleague to a vendor thread or take someone off it before sending. ### **4. Bring Your Team In Before You Send** Comment underneath any individual message in a thread, or on the email event itself. Comments are visible to your team and stay attached to that message, which is how you flag a specific line in a vendor's reply rather than commenting on the Relationship as a whole. The renewal notice arrives. You comment asking a teammate to pull the usage numbers before anyone responds. The exchange sits with the email that prompted it, so the next person to open the thread inherits the thinking as well as the facts. Nothing moves to Slack and gets lost. Updated 01 ### **5. Contacts: Two Controls, One Menu** The Contacts tab in the Relationship details panel is the answer to "why is this email here?" An email appears on the Relationship because a contact or a domain in this list matches one of its participants. Change the list and the timeline changes with it, including for correspondence already in BRM. Named people sort to the top. Role mailboxes and automated senders sort below them. Each row shows where BRM learned about the contact and when it was last active. Visible domains automatically add matching contacts, so adding a vendor's primary domain is the fastest way to populate a quiet Relationship. Open the menu on any contact, and you get two options: 1. **Make my emails with contact private.** Your side of the conversation stops being shared with your organization. Use this when the correspondence is vendor-related and still yours. 2. **Hide contact from relationship.** That contact's email stops appearing in the Relationship feed for everyone. Use this for the marketer sending campaign email or the system sending automated notifications. The contact stays on file, so anyone looking for someone to reach out to can still find them. 06 ### **6. Your Exclusions Always Win** Some correspondence is relevant to a vendor and still yours. A conversation with your own lawyer about an agreement. Anything touching compensation. A contact you happen to know personally. BRM ships a suggested set of exclusions based on what most teams keep private, and you can add your own addresses and domains on top. Anything on that list is never shared with your organization, whatever the Relationship settings say. You can also exclude in the moment, straight from a thread on the Relationship page, for the times you spot something in the feed that should not be there. 💡 **TIP** If a relationship has no contacts yet, that is deliberate. BRM only asserts a contact when it is confident, because a wrong contact pulls the wrong email onto a Relationship. Add the vendor's domain from the Contacts tab, and BRM will pull the matching correspondence in automagically, including mail already in the system. ## **Why This Changes How You Work** ### **Before a renewal call** Open the Relationship. Read the overview, check the spend, then scroll the conversation that got you here. Ask BRM to draft the agenda email. You are reading the Relationship rather than reconstructing it from memory and a PDF. ### **When a price increase lands** **The old way:** find the contract, check what you actually agreed to, search your inbox for what was said about renewal pricing last time, ask a colleague who might remember, then write a careful reply from scratch. Ninety minutes, and you are still not certain you have the full picture. **The new way:** open the Relationship. The contract, the spend trajectory, and the previous negotiation are all on the page. Ask BRM to push back, citing the term you signed. Comment to bring your teammate in. Edit and send. ### **When the person who owned a vendor leaves** Their correspondence with that vendor stays on the Relationship. The commitments made over email, the escalation that got resolved, the discount confirmed in a reply and never written into an amendment. Institutional memory stops walking out of the door with people. ### **When someone asks "what did we tell them?"** You open the page instead of asking three colleagues to search their inboxes. ## **Frequently Asked Questions** **Can my colleagues read all of my email now?** No. Only correspondence matching a contact or domain on a vendor relationship is surfaced, and only on that relationship's page. Anything on your exclusions list is never shared, and BRM does not surface personal email with no vendor relationship attached. **What is the difference between hiding a contact and making emails private?** Hiding a contact removes their email from the relationship feed for everyone in your organization. Making emails private removes your messages with that contact from the shared view, and only yours. Your teammates' correspondence with the same contact is unaffected. **An email is on the wrong relationship. How do I fix it?** Hover over the email and click the flag to report bad data, and our team will take a look. **A thread I expected is missing.** Check whether the sender appears in the Contacts tab. If not, add their address or the vendor's domain. If they are listed but hidden, unhide them. **Does this work with a shared or group inbox?** Group inboxes are not supported directly, the same limitation that applies to Contract Collector. If a member of the group has connected their own inbox, correspondence reaching that account is picked up. ## **Need help?** If you have questions about Email in The Relationship or need help getting set up, reach out to our support team, and we will be happy to help.
# Gemini Enterprise Agent Platform Usage Integration Source: https://docs.brm.ai/google-vertex-ai-usage-integration This article walks you through connecting your Google Vertex AI project to BRM so we can show your team's per-model token usage and spend. ***Why this matters:***\_ AI spend on hyperscalers like Google Cloud is easy to lose inside a much larger cloud bill. This connection gives you a clear, per-model view of what's actually running and what it costs.\_ ⚠️ **Important:** This is **not** a Gemini API key from AI Studio. BRM needs a **Google Cloud service-account key**, which is a different type of credential created inside your Google Cloud project. The setup has three steps, outlined below. Complete steps 1 and 2 in Google Cloud first, then connect in BRM to complete step 3: 1. **Set up token usage tracking** — in a Google Cloud service account with read-only access to Cloud Monitoring. 2. **Set up spend** tracking — with a one-time billing export to BigQuery, plus read-only BigQuery access for the same service account. 3. **Connect in BRM** — enter the project ID, service-account key, and billing export details together. If you are able, complete the spend setup **before** you connect. The billing export only starts collecting data from the moment you turn it on, so every day it's off is another day of untracked spend history. If you are unable to get billing-admin access yet, you can connect with token usage only and add the spend details later by reconnecting the integration. ℹ️ Google Cloud only keeps about six weeks of monitoring history, so token usage builds up going forward rather than backfilling years of past data. Spend is different: BRM pulls up to a year of history from the billing export — but the export itself only contains data from the date it was enabled. ## What you'll need | **Credential** | Google Cloud service-account JSON key | | :- | :- | | **Also needed** | The GCP project ID where your Vertex AI traffic runs | | **Roles for token usage** | Monitoring Viewer on that project | | **Roles for spend** | BigQuery Data Viewer (on the billing-export dataset)
and BigQuery Job User (on the billing-export project) | | **Spend details** | Billing-export project ID, dataset name, and billing account ID | | **Who can do this** | A project IAM admin or owner, plus a billing admin for the spend integration | ## Part 1: Token usage | **Credential** | Google Cloud service-account JSON key | | :- | :- | | **Also needed** | The GCP project ID where your Vertex AI traffic runs | | **Role required** | Monitoring Viewer on that project | | **Who can do this** | A project IAM admin or owner | ### Step 1: Identify your project Find the GCP project ID where your Vertex AI traffic runs. You'll enter this into BRM later. ### Step 2: Enable Cloud Monitoring In Google Cloud Console, ensure the **Cloud Monitoring API** is enabled for this project. If you're comfortable with the command line, you can accomplish this with the following command: ```bash theme={null} gcloud services enable monitoring.googleapis.com --project=PROJECT_ID ``` ### Step 3: Create a service account [Create a new service account](https://docs.cloud.google.com/iam/docs/keys-create-delete) and name it brm-vertex-usage. Command-line equivalent: | `gcloud iam service-accounts create brm-vertex-usage \` `  --project=PROJECT_ID \` `  --display-name="BRM Vertex AI usage read-only"` | | - | ```bash theme={null} gcloud iam service-accounts create brm-vertex-usage \ --project=PROJECT_ID \ --display-name="BRM Vertex AI usage read-only" ``` ### Step 4: Grant the Monitoring Viewer role Grant the service account the [**Monitoring Viewer** role](https://docs.cloud.google.com/iam/docs/roles-permissions/monitoring) (roles/monitoring.viewer) on the project. This is read-only — it does not let BRM change anything in your Google Cloud project. Command-line equivalent: ```bash theme={null} gcloud projects add-iam-policy-binding PROJECT_ID \ --member="serviceAccount:brm-vertex-usage@PROJECT_ID.iam.gserviceaccount.com" \ --role="roles/monitoring.viewer" ``` ## Part 2: Spend ℹ️ Claude models on Vertex AI bill as their own line item (for example, "Claude Opus 4.6"), rather than a single generic "Vertex AI" line. BRM automatically matches these billing rows back to the same models you see in token usage, so spend and usage line up per model. ### Step 1: Turn on the detailed billing export In Google Cloud Console, go to **Billing → Billing export → BigQuery export → Detailed usage cost → Edit settings**. Choose or create a BigQuery dataset to receive the [export](https://cloud.google.com/billing/docs/how-to/export-data-bigquery), then save. A billing admin needs to do this step. ⚠️ It must be the **Detailed usage cost** export. The "Standard usage cost" export writes a different table that BRM can't use. ℹ️ Google doesn't offer a command-line way to turn this export on — it must be done in the console. After you enable the export, Google creates the export table (named `gcp_billing_export_resource_v1_...`) on its first export run. This can take a few hours, occasionally up to a day. **Wait until the table appears in the dataset before connecting in BRM**. BRM verifies it can read the table when you connect, so connecting too early will fail. ### Step 2: Share the BigQuery dataset with your service account Go to **BigQuery → select the billing-export dataset → Sharing → Permissions → Add principal**. Then add `brm-vertex-usage@PROJECT_ID.iam.gserviceaccount.com` (using your Vertex project's ID) with the role [**BigQuery Data Viewer**](https://cloud.google.com/bigquery/docs/control-access-to-resources-iam), and save. ℹ️ Grant access at the **dataset** level. Sharing only the export table itself is not enough — BRM needs dataset-level read access to find and query the table. ### Step 3: Grant BigQuery Job User Grant the service account **BigQuery Job User** (roles/bigquery.jobUser) on the project that holds the billing export. This is often a different project from the one running your Vertex AI traffic. Command-line equivalent (replace both placeholders with your real project IDs): ```bash theme={null} VERTEX_PROJECT="PROJECT_ID" # project running Vertex AI traffic BILLING_EXPORT_PROJECT="BILLING_EXPORT_PROJECT_ID" # project holding the billing export gcloud projects add-iam-policy-binding "$BILLING_EXPORT_PROJECT" \ --member="serviceAccount:brm-vertex-usage@${VERTEX_PROJECT}.iam.gserviceaccount.com" \ --role="roles/bigquery.jobUser" ``` ### Step 4: Note down the billing export details You'll enter these into BRM in the next part, alongside the project ID and key: * The billing-export project ID * The billing-export dataset name * The billing account ID (shown on the Billing export page, e.g. ABCDEF-123456-789ABC) ## Part 3: Connect in BRM ### Step 1: Create a JSON key Create a JSON key for the service account and download it. Command-line equivalent: ```bash theme={null} gcloud iam service-accounts keys create brm-vertex-usage-key.json \ --iam-account=brm-vertex-usage@PROJECT_ID.iam.gserviceaccount.com ``` ℹ️ If this step fails with an organization-policy error, your GCP organization may block service-account key creation (`iam.disableServiceAccountKeyCreation`). Ask your GCP org admin to allow an exception for this service account. ### Step 2: Enter everything in BRM In BRM, open the Google Vertex AI integration setup, found by clicking on your profile in the lower-left hand corner of the screen, navigating to Integrations, then clicking on "Connect" next to "**Gemini Enterprise Agent Platform**" and enter: * Your GCP project ID * The full contents of the JSON key file * The billing-export project ID * The billing-export dataset name * The billing account ID Screenshot 2026 07 07 At 1 57 42 PM ℹ️ The three billing-export fields go together — fill in all three. (If you're connecting with token usage only for now, leave all three empty; entering just one or two won't work.) ### Step 3: Delete your local copy of the key Once it's entered into BRM, delete the local copy of the JSON key file from your computer, unless your security policy requires you to keep a managed backup. ## Part 2: Spend The billing export is forward-only — it starts collecting from the moment you turn it on and will not backfill older billing history. | **Already have** | The service account from Part 1 | | :- | :- | | **New roles needed** | BigQuery Data Viewer (on the billing export dataset)
and BigQuery Job User (on the billing export project) | | **Also needed** | Billing-export project ID, dataset name, and billing account ID | | **Who can do this** | A billing admin, in addition to the project IAM admin from Part 1 | Navigate to **BigQuery → select the billing-export dataset → Sharing → Permissions → Add principal**. | `VERTEX_PROJECT=PROJECT_ID` `BILLING_EXPORT_PROJECT=BILLING_EXPORT_PROJECT` `gcloud projects add-iam-policy-binding "$BILLING_EXPORT_PROJECT" \` `  --member="serviceAccount:brm-vertex-usage@${VERTEX_PROJECT}.iam.gserviceaccount.com" \` `  --role="roles/bigquery.jobUser` | | - | ## Multiple projects Set up **one BRM integration per Vertex AI project**. If you run Vertex AI traffic in several projects, you don't need a separate service account for each: grant the one service account Monitoring Viewer on each project (or at the folder or organization level), and create one BRM integration per project, all using the same key. ## Security notes * Token usage only requires Monitoring Viewer — a read-only role. * Spend only adds BigQuery job execution plus dataset-scoped read access — also read-only. * BRM cannot run inference, read prompts or responses, or change any Google Cloud resources or billing settings with these roles. * You can rotate or revoke the service-account key at any time from Google Cloud. Note that revoking the key stops BRM's syncing until you enter a new key by reconnecting the integration in BRM. ## Common mistakes * **Sending a Gemini API key instead of a service-account JSON key.** These are different credential types — BRM needs the service account. * **Granting Vertex AI permissions but not Monitoring Viewer.** BRM reads from Cloud Monitoring specifically; thus the integration requires this role. * **Turning on the Standard usage cost export instead of Detailed usage cost.** BRM reads the detailed (resource-level) export table. * **Connecting in BRM before the export table exists.** Google creates the table on the first export run after you enable it, which can take up to a day. Wait for it to appear, then connect. * **Entering only some of the billing export fields.** The billing-export project ID, dataset name, and billing account ID go together — enter all three or none. * **Granting BigQuery access too broadly — or too narrowly.** Use dataset-scoped "BigQuery Data Viewer" on the billing-export dataset: not project-wide access, and not table-only access either. * **Pointing one integration at multiple projects.** Set up one BRM integration per Vertex AI project (they can share a service account — see "Multiple projects" above). ## Provider documentation Our steps above should stay current, but if Google Cloud changes their interface, these are the source-of-truth docs: * [Create and delete service-account keys](https://docs.cloud.google.com/iam/docs/keys-create-delete) * [Service-account credentials](https://docs.cloud.google.com/iam/docs/service-account-creds) * [Cloud Monitoring roles and permissions](https://docs.cloud.google.com/iam/docs/roles-permissions/monitoring) * [Cloud Monitoring timeSeries.list API](https://docs.cloud.google.com/monitoring/api/ref_v3/rest/v3/projects.timeSeries/list) * [Google Cloud metrics overview](https://docs.cloud.google.com/monitoring/api/metrics_gcp) * [Cloud Billing export to BigQuery](https://cloud.google.com/billing/docs/how-to/export-data-bigquery) * [BigQuery IAM access](https://cloud.google.com/bigquery/docs/control-access-to-resources-iam) ## Still stuck? Reach out to BRM support and let us know which step you're stuck on. Don't send your JSON key over email or chat — we'll point you to a secure way to share it if needed. # IAM Integration FAQs Source: https://docs.brm.ai/identity/IAM **What access does BRM need?** BRM needs **view** access for the user directory and audit logs in your IAM systems. For Okta, this is specifically requesting permission for the `okta.users.read`, `okta.apps.read`, `okta.logs.read` scopes. For Google, this is specifically requesting permission for the `reports.audit.readonly` and `directory.user.readonly` scopes. **Specifically what data is BRM ingesting and storing?** BRM is only ingesting authentication and revoke logs from these systems. When users in your org authenticate into an application that your IAM system has (e.g. Salesforce), a log with the user ID and timestamp is created. BRM aggregates these logs to provide you digestible app utilization data. **Can BRM change the permissions it has access to?** You, as the Google or Okta admin, are fully in control with what permissions to provide to BRM. \ BRM’s access will never expand or change without you as the Okta admin changing the permissions it provides BRM. **Does BRM have access to our login credentials?** BRM never reads or stores your Okta login credentials (user/password). That information is never provided to BRM and BRM will never be able to login to your Okta instance. **How far back are you looking historically?** Upon initial sync, BRM will do the following for Google/Okta * For Google, BRM will look back up to [6 months](https://support.google.com/a/answer/7061566?product_name=UnuFlow\&hl=en\&visit_id=638677446324915980-2283360776\&rd=1\&src=supportwidget0\&hl=en) worth of data. This is the longest timeframe in which Google will retain audit report data. * For Okta, BRM will look back up to [3 months](https://support.okta.com/help/s/article/Customer-Data-Retention-Policy?language=en_US) worth of data. This is the longest timeframe in which Okta will retain authorization logs. Once initial sync is complete, BRM will update this data every 15 minutes going forward. As you use BRM over time, you'll build up more historical data than your IAM system will even save for you. # Google SSO Source: https://docs.brm.ai/identity/googlesso ## Authenticating Google SSO Authenticating Google SSO to BRM is quick and easy. Even if your organization uses Okta as the primary SSO provider, there are certainly a number of tools that are ***not*** behind Okta. This puts your business at risk. The Google integration provides visibility into what InfoSec teams call "Shadow IT". To authenticate BRM to your organization's Google SSO logs, **you must be a Google workspace admin**. The below video shows how to quickly authenticate Google SSO.