Architecture
Your data stays in place. The language model never touches it.
AgenticObjects runs in your environment. The only components that touch data are read-only gateways. The language model cannot reach the database, the authorization layer or query execution: it receives the sealed query results a sentence needs, and nothing else — no database connection, no credential. And the model selected for a run cannot change while the run is going.
The boundary
Where the AI can and cannot reach
Where the AI cannot reach
What the AI does
The control chain
Six controlled stages between your data and the sentence. The model is in one of them.
The trust model does not rely on prompting. It relies on a deterministic control chain — and on recording what that chain refused.
01Business Overlay
One authoritative, versioned definition per metric, built and deployed in Model Studio. If a question does not match a definition, the system says so instead of guessing. The model is not consulted about what a metric means.
02Query Composer
Deterministic query construction from the deployed Business Overlay. The model never writes the query that runs.
03Read-only gateway
The only component that touches your data. Write and multi-statement forms are rejected at the gateway grammar before they reach the database. No write path exists by design.
04Narration
Reads the sealed results and writes the sentence — nothing else. Every number it uses must declare its address. It cannot divide; it asks the engine for the ratio.
05FinalGuard
A rule-based comparator, not an AI. A number without a source, inconsistent with the query, or written before a query ran is rejected. There is no setting, no permission and no button to disable it. Comparison takes about two milliseconds — demo measurement.
06Publication gates
Eight deterministic checks decide whether a candidate becomes a record: structure, authority freeze, evidence, trust stamp, claim check, novelty, deduplication, cardinality. The AI proposes; the engine decides.
Four architectural facts
The parts that do not move
Each of these services is operated from the Central Administration Console and its Service Configuration Manager.
On-premise
The app, runtime, Business Overlay and object repository run on your server. Analysis goes to the data, and the data is never copied. The only calls that leave are to the model provider you chose, carrying the sealed results a sentence needs.
Read-only
Two gateways touch data and both are read-only. Write and multi-statement forms are rejected at the gateway grammar before they reach the database.
Model isolation
The model sees text only. Database credentials, the direct data path and authorization decisions are outside its reach.
One model per run
Once a run starts, the selected model does not change: not for a slow or failing provider, and not because a first answer looked weak. No automatic fallback, no quality-triggered escalation. Bring your approved model, and it is the one on the record when someone asks six months from now.
Under the hood
Where exactly is the AI involved? Your technical team will ask.
| Component | Responsibility |
|---|---|
| Web Portal | The Central Administration Console for administrators and the Briefing Room for business users; routing and authorization |
| Analysis Engine | The agent loop: plan, call tools, evaluate; every step an idempotent event. Its worker pool keeps chat answers and scheduled runs in separate lanes |
| Query Composer | Builds the query deterministically from the deployed Business Overlay; the language model never writes it |
| Data Gateway | The only hand that touches relational data; read-only by grammar |
| Microsoft SSAS Gateway Service | Runs on your server; SSAS Tabular cube access via DAX, read-only; your cube credentials stay there |
| Storage and queue | Relational system-of-record for the product; a queue for runs |
| Model Studio | Builds, reviews, versions and deploys the Business Overlay: one versioned definition per metric; the AI may propose, a person approves |
If a run is interrupted, it resumes from the first incomplete step. A completed step never runs again — no duplicate cost, no duplicate finding.
Governance
Authority never shifts. The budget freezes. Everything is on the record.
Authority
- Four roles with a clear hierarchy: viewer, editor, admin, company admin.
- Sensitive actions come from named permissions, not roles: seeing the executed SQL, running experiments, raising a budget.
- Row-level security: the administrator defines the rule; the system generates the filter clause. If the identity cannot be resolved, it stops.
- Policy as code: permissions live in a single source from which guard, middleware and tests are generated.
- Even learning is human-gated: a lesson an agent proposes waits for a person’s approval, unless an administrator switches on that agent’s auto-learn.
Budget
- Every run has a ceiling — steps, seconds, cost — and it freezes when the run starts.
- An agent can only narrow its limits, never widen them. A channel can change the budget, never the authority.
- A run that exhausts its budget stops and is labelled cut off (budget). Cost is calculated once and never changes again.
Record
- Append-only audit log; every button press carries the name of whoever pressed it.
- Nothing is physically deleted — there is no delete endpoint. Invalidated records are archived.
- Experiments do not contaminate production: they record but do not distribute — no notifications, no briefs, nothing in the feed.
Security posture
One sentence for your security team: the data stays in place, the system only reads, every step is on the record.
- Data is never copied. A read-only connection; analysis goes to the data. Personal data is processed in place.
- Writing is technically impossible. Two separate locks: a grammar check before the query reaches the database, and a read-only connection.
- Your credentials never reach us. They stay encrypted on your server; the runtime uses a pairing key and signed messages.
- In doubt, the system stops. Fail-closed by design: exceeding a row limit is an error, not a silent truncation; no identity means no data.
- Everything is recorded. Frozen budget and model per run; every object stamped with the identity that produced it.
Data sources
Supported sources
SQL Server and MariaDB / MySQL through the Data Gateway, and SQL Server Analysis Services (Tabular) models through the Microsoft SSAS Gateway Service. Other relational sources with a JDBC driver are added on request. Connector availability for your specific platform is confirmed in week one of the pilot, before anything else is scheduled.