Governance

Governance enforced at the point of execution, not just at catalog time. When an AI agent queries data through Plexara, access controls, audit trails, and quality signals are enforced by the same platform that executes the query.

The Gap

Catalog-Time vs. Execution-Time Governance

Aspect	Catalog-Time	Execution-Time (Plexara)
PII Classification	Tag exists in catalog. Agent can still query the data through a separate connection.	Persona filtering blocks unauthorized tool access. PII tag surfaces in every enriched response.
Access Control	Policy defined in catalog. Enforcement depends on downstream systems honoring it.	Default-deny posture. No persona means zero tool access. Enforced on every request.
Audit Trail	Catalog logs metadata reads. Query execution logged separately in the database.	Single audit log captures user identity, persona, tool, connection, duration, and outcome.
Deprecation	Deprecation notice in catalog. Agent may never check the catalog before querying.	Deprecation warning included in every query response for the deprecated dataset.

The Personas admin screen with a Data Engineer persona selected, showing its identity, roles, and priority on the left, allow and deny patterns below, and a live What can Data Engineer do preview listing each tool as allowed or denied with the pattern it matched — A persona is written as allow and deny patterns, and the preview beside them shows the resulting tool list before you save.

The Visibility tab for the Trino Query tool in the Tools admin screen, with a global kill-switch card, a Persona access table listing each persona's decision and matched pattern, and a field to preview the decision for any persona name — Flip it around and ask one tool who can reach it: every persona, its decision, and the pattern that produced it.

Authentication

Fail-Closed by Default

Missing or invalid credentials deny access. No persona assigned means zero tool access. Misconfiguration results in denied access, never unauthorized access.

OIDC

OpenID Connect with required JWT claims (sub, exp). Integrates with any enterprise identity provider.

Use case: Interactive users through AI clients and web interfaces.

OAuth 2.1

Full OAuth 2.1 with PKCE for public clients and Dynamic Client Registration. Built-in authorization server.

Use case: Third-party integrations and delegated access patterns.

API Keys

Managed API key authentication for service accounts and automation workflows.

Use case: Machine-to-machine communication and CI/CD pipelines.

Audit

Every Tool Call Logged

Comprehensive audit logging with PostgreSQL storage and configurable retention. The audit log captures what happened, who did it, under what authority, and through which data path.

Platform-level logging captures tool calls invisible at the database level. A database log shows a query from a service account. The platform log shows which human initiated the session, which persona they used, and which tool call triggered the query.

Captured per tool call

User IdentityAuthenticated user from IdP

PersonaResolved role-based persona

ToolMCP tool that was invoked

ConnectionTarget data source connection

DurationExecution time in milliseconds

OutcomeSuccess, failure, or denied

The Events tab of the admin Dashboard, a searchable and filterable table of tool calls with timestamp, user, tool, toolkit, source, connection, duration, status, and enriched columns, plus Export CSV and Export JSON buttons — The audit log as your admins see it: one row per tool call, filterable and exportable.

Safeguards

Operational Controls

Read-Only Enforcement

Trino and S3 connections can be locked to read-only mode, blocking write operations at the platform level.

S3 Prefix ACLs

Restrict storage access to specific S3 paths. Agents cannot browse or retrieve objects outside allowed prefixes.

Workflow Gating

Session-aware enforcement tracks whether discovery tools were called before query tools, with configurable escalation.

Prompt Safety

Catalog metadata is screened for suspicious instruction patterns before enrichment, and detections are logged. This reduces exposure but cannot catch every phrasing; it is one layer in the shared-responsibility defense detailed on the Security page.

Supply Chain Provenance

Signed build provenance (GitHub artifact attestations) with SAST (Semgrep, CodeQL), race detection, gosec, and OpenSSF Scorecard.

Query Limits

Configurable default and maximum row limits, query timeouts, and connection-level resource controls.

Email Notifications

How a share, a mention, or an unworked review queue reaches a person who is not looking at the portal.

Continue