Appendix EConnector and Broker Policy Catalogue
3 min readFrom Sovereign AI Engineering by Miguel AmigotLast updated
A starting catalogue of the systems a sovereign platform should reach through Model Context Protocol connectors, by sector, with the scopes a broker policy should distinguish and the audit fields every call produces. It is a template to be edited into the institution's own policy table, not a complete list.
Audit fields every call produces
Whatever the connector, the broker writes one line per call with these fields. They are the minimum a regulator, an auditor or an incident review will ask for.
| Field | Content |
|---|---|
timestamp | When the call was made |
user | The person on whose behalf the call was made |
role | The role the policy was evaluated against |
agent | The agent that made the call |
surface | Web, side panel, desktop, mobile, terminal, scheduled |
tool | Connector and tool name |
scope | The scope granted: self, caseload, department, organization |
parameters | The call's inputs, with secret fields redacted |
decision | Allowed or denied, and the policy rule that decided |
result_size | Rows or bytes returned |
classification | The data classification of what was returned |
model_target | Which model later received the result, from the router |
Higher education
| System | Example products | Read scopes | Write scopes | Classification |
|---|---|---|---|---|
| Student information system | Banner, PeopleSoft Campus, Jenzabar, Colleague | Own record (student); caseload (advisor); program (chair); all (registrar) | Holds, notes (registrar roles only) | Restricted (FERPA) |
| Learning management system | Canvas, Blackboard, D2L, Moodle | Own courses (student); taught courses (instructor); all (admin) | Announcements, grades (instructor) | Restricted |
| Recruitment and advancement CRM | Slate, Salesforce | Own territory (recruiter); all (director) | Notes, tasks | Confidential |
| Advising platform | EAB Navigate and equivalents | Caseload | Notes, alerts | Restricted |
| Ticketing and service desk | ServiceNow, TeamDynamix, Jira Service Management | Own tickets (requester); queue (agent) | Create, comment, resolve | Internal |
| Identity directory | Active Directory, Okta, institutional IdP | Own profile; lookup by role | None | Internal |
| Document stores | Google Drive, SharePoint, Box | Own and shared-with-me | Create in own space | Varies by item |
| Library and research databases | Discovery layers, publisher APIs | Catalogue search | None | Public |
Enterprise
| System | Example products | Read scopes | Write scopes | Classification |
|---|---|---|---|---|
| CRM | Salesforce, HubSpot, Dynamics | Own accounts; team; all | Notes, tasks, opportunity fields | Confidential |
| ERP and finance | SAP, Oracle, NetSuite, Workday Financials | Own cost centre; department; all | Draft journal entries, approvals (finance roles) | Restricted |
| HR system | Workday, SuccessFactors, BambooHR | Own record; direct reports; all (HR) | Time-off requests | Restricted |
| Support desk | Zendesk, Freshdesk, Intercom | Own tickets; queue | Create, reply, resolve | Internal |
| Project and work tracking | Jira, Asana, Monday | Own projects; team | Create, update | Internal |
| Collaboration | Slack, Teams, email | Own channels and mail | Post, send (approval recommended) | Internal |
| Data warehouse | Snowflake, BigQuery, Redshift | Governed views by role | None | Varies by view |
| Contracts and documents | DocuSign, SharePoint, Box | Own and shared | Create drafts | Confidential |
Healthcare
| System | Example interfaces | Read scopes | Write scopes | Classification |
|---|---|---|---|---|
| Electronic health record | FHIR APIs; vendor-sanctioned interfaces | Own patients (clinician); panel (care team); none (non-clinical) | Draft notes only, clinician review required | Restricted (HIPAA); local models only |
| Scheduling | Practice management systems | Own schedule; department | Requests | Restricted |
| Clinical documents | Document management | Own patients | None | Restricted |
| Billing | Revenue cycle systems | Department | None | Restricted |
Healthcare connectors should route exclusively to models on the restricted list, which in practice means local inference on institution hardware.
Legal and financial services
| System | Example products | Read scopes | Write scopes | Classification |
|---|---|---|---|---|
| Matter and case management | Clio, iManage, NetDocuments | Own matters; practice group | Notes, drafts | Privileged; local models recommended |
| Document management | iManage, NetDocuments, SharePoint | Own and matter-shared | Create drafts | Privileged |
| Billing and time | Clio, Elite, Aderant | Own entries; partner view | Time entries | Confidential |
| Market and reference data | Vendor feeds | Licensed scope | None | Licensed |
| Research databases | Legal and financial research platforms | Licensed scope | None | Licensed |
| KYC, AML and compliance | Screening and case tools | Own queue; compliance team | Case notes, escalations (approval required) | Restricted |
Writing the policy table from the catalogue
Each row above becomes several rows in the broker's policy table: one per role and tool, with the scope the role gets and whether the tool may write. Three rules keep the table honest.
- Start empty. Deny by default; add the first agent's needs; add the next agent's. The table should read as a history of deliberate grants.
- Scope before allow. Never grant a role "all" when "own" or "caseload" is what the agent needs. The source system's own permissions are the backstop, not the control.
- Writes require an approval mode. Any tool that changes a system of record should be paired with the ask-first approval mode in the harness, at least until the agent has an evaluation history.
Run the stack this book describes
ibl.ai is the agent operating system you run yourself: you own all the code and the data, in your cloud, on-premise or air-gapped, with any model, one identity across web, browser, desktop, mobile and terminal, and no per-seat pricing.