Plexara
Governance
The Gap
Catalog-Time vs. Execution-Time Governance
| Aspect | Catalog-Time | Execution-Time (Plexara) |
|---|---|---|
| PII Classification | Tag exists in catalog. Agent can still query the data through a separate connection. | Persona filtering blocks unauthorized tool access. PII tag surfaces in every enriched response. |
| Access Control | Policy defined in catalog. Enforcement depends on downstream systems honoring it. | Default-deny posture. No persona means zero tool access. Enforced on every request. |
| Audit Trail | Catalog logs metadata reads. Query execution logged separately in the database. | Single audit log captures user identity, persona, tool, connection, duration, and outcome. |
| Deprecation | Deprecation notice in catalog. Agent may never check the catalog before querying. | Deprecation warning included in every query response for the deprecated dataset. |
Authentication
Fail-Closed by Default
Missing or invalid credentials deny access. No persona assigned means zero tool access. Misconfiguration results in denied access, never unauthorized access.
OIDC
OpenID Connect with required JWT claims (sub, exp). Integrates with any enterprise identity provider.
Use case: Interactive users through AI clients and web interfaces.
OAuth 2.1
Full OAuth 2.1 with PKCE for public clients and Dynamic Client Registration. Built-in authorization server.
Use case: Third-party integrations and delegated access patterns.
API Keys
Managed API key authentication for service accounts and automation workflows.
Use case: Machine-to-machine communication and CI/CD pipelines.
Audit
Every Tool Call Logged
Comprehensive audit logging with PostgreSQL storage and configurable retention. The audit log captures what happened, who did it, under what authority, and through which data path.
Platform-level logging captures tool calls invisible at the database level. A database log shows a query from a service account. The platform log shows which human initiated the session, which persona they used, and which tool call triggered the query.
Captured per tool call
Safeguards
Operational Controls
Read-Only Enforcement
Trino and S3 connections can be locked to read-only mode, blocking write operations at the platform level.
S3 Prefix ACLs
Restrict storage access to specific S3 paths. Agents cannot browse or retrieve objects outside allowed prefixes.
Workflow Gating
Session-aware enforcement tracks whether discovery tools were called before query tools, with configurable escalation.
Prompt Safety
Catalog metadata is screened for suspicious instruction patterns before enrichment, and detections are logged. This reduces exposure but cannot catch every phrasing; it is one layer in the shared-responsibility defense detailed on the Security page.
Supply Chain Provenance
Signed build provenance (GitHub artifact attestations) with SAST (Semgrep, CodeQL), race detection, gosec, and OpenSSF Scorecard.
Query Limits
Configurable default and maximum row limits, query timeouts, and connection-level resource controls.