Local saves an SBOM as a build artifact and needs no credential. Check sends inventory to Monitor and returns findings without saving inventory or changing alerts. Sync immediately replaces only the credential's source; use it after a successful deployment with a separate Sync credential and administrator approval. Partial/empty inventories cannot sync. Use Validate configuration only to inspect setup without sending anything.