Enterprise systems speak REST, SOAP, OData. Agents speak natural language. EAG is the layer in between — one canonical, plain-language tool catalog fronting every backend, governed on every call.
🗂️
One Canonical Tool Catalog
A single, stable, natural-language contract agents route on. EAG maps each canonical tool to the right backend call. Descriptions are written for the model, so the agent's own LLM does the matching — in whatever language the user speaks.
🔐
Identity-Aware, Per User
Entra SSO in; OAuth On-Behalf-Of downstream where the backend supports it, so its own row-level security applies. Elsewhere EAG resolves the caller and filters to their rows — the identity on every call is the real user, never an anonymous “the app”.
🛡️
Governed by Tier
Read / write / privileged tiers with policy gates: confirm-before-write, privileged actions blocked or approval-gated. The agent can't do more than the caller's role allows.
🧾
Audited End to End
Every call recorded — user, tool, system, outcome, latency. A ready-made compliance trail and seat-metering feed, exportable to your SIEM. The audit is the proof, not a vibe.
🔌
Any Backend, Even Legacy
REST, Workday RaaS, OData, SQL — modern APIs and legacy systems alike, added with a manifest and the console's Connect dialog (validate before you enable). Federate anything that already speaks MCP with zero driver code.
♻️
Migration Insurance
You license the catalog, not the backends. Swap ServiceNow → Jira or SAP ECC → S/4HANA one tool at a time, with a rollback toggle and an audit trail — and your agents never change.
🖥️
Admin Console Built In
One signed-in console runs the whole estate: flip systems on and off, connect backends with validate-before-enable, author tool-to-table mappings against live metadata, watch every call stream in, and manage user roles — no YAML required for day-two ops.
🔎
Identity Probe
Answer "what would this user see?" before they ask. Probe any scope set and get the exact tool list that identity would be served — allowed, gated, or hidden, with the policy reason — governance you can demonstrate, not assert.
🧪
Stage It, Then Scale It
No API yet? Model a target system in Dataverse, serve it live and governed through the same canonical catalog, and prove the agent experience on staged data. When you're ready, repoint the manifest to the real backend — and all agent traffic switches in seconds. Model → Stage → Prove → Repoint → Production.
🔑
One Image, Offline-Licensed
One container, one config-per-customer. A signed key unlocks your tier — verified offline, so it runs air-gapped with no phone-home. Every install starts with a 30-day trial of everything.
