AegisAI is a single FastAPI surface that any AI agent (Copilot, Joule, Claude, ChatGPT, Gemini, LangChain) can talk to. Behind it, nine deterministic stages enforce per-user identity, deterministic policy, and field-tag masking across 31 backend integrations: SAP, Snowflake, Databricks, BigQuery, RDS, Synapse, Salesforce, MongoDB — and 23 more.
Each stage of the 9-stage pipeline. Deterministic, deny-by-default, and independently auditable.
HS256, RS256, ES256, PS256. JWKS rotation. Issuer and audience verification. Configurable clock-skew leeway.
SAP BAPI_USER_GET_DETAIL + ACTIVITYGROUPS / PROFILES. Salesforce profile permissions. Workday OAuth scopes. ServiceNow ACLs. Each backend's native model.
AWS simulate_principal_policy, Azure RBAC, GCP testIamPermissions, Snowflake Unity Catalog, Databricks workspace ACLs. Fail-closed on connector error.
Frequency, scope expansion, coverage growth, cross-user coordination. Trust score drives rate-limit bands.
Priority-weighted expression set evaluated by a safe AST whitelist. Deny-by-default, deny-wins-on-tie.
Intent compiles into SafeQuery. :named placeholders only. Tenant isolation as a row policy on every entity.
MODE-gated dispatch across SAP / cloud DWH / SaaS / NoSQL. PRODUCTION refuses simulators. Identity propagates to each backend natively.
Schema-driven response firewall. Per-field classification × user clearance × auth-object gate.
Tamper-evident HMAC chain. Postgres-backed, row-locked append. Public /api/audit/integrity probe.
Each connector ships with its production-grade authority lookup. No fixtures masquerading as IAM checks.
Identity propagation via SAP Logon Ticket or user credentials. Authority lookup walks BAPI_USER_GET_DETAIL; per-object field-value enforcement via SUSR_USER_AUTH_FOR_OBJ_GET.
pyrfcPrincipal ARN resolved via STS GetCallerIdentity; permission checked via iam:SimulatePrincipalPolicy per request.
Authentication via DefaultAzureCredential. Permission checked via Azure RBAC role-assignments at request scope.
Service-account credentials with Workload Identity Federation. Permission checked via testIamPermissions on the project resource.
30-minute architecture call. We walk through your data sources, your auth model, and what a 4.2026a-compatible AI integration looks like for your stack.